diff --git a/CHANGELOG.md b/CHANGELOG.md index 1db617ff5..1e4a35e8f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,25 @@ ## [Unreleased] +## [4.9.0] - 2021-06-01 + +* Update PowerSTIG to successfully parse/apply Microsoft Office 365 ProPlus STIG - Ver 2, Rel 2: [#887](https://github.com/microsoft/PowerStig/issues/887) +* Update PowerSTIG to successfully parse/apply Windows 10 STIG V2 R2: [#891](https://github.com/microsoft/PowerStig/issues/891) +* Update PowerSTIG to successfully parse/apply Microsoft Windows 2012 R2 DC STIG- Ver 3, Rel 2 [#902](https://github.com/microsoft/PowerStig/issues/902) +* Update PowerSTIG to successfully parse/apply Microsoft IIS 10.0 SITE/SERVER STIG V2R2: [#882](https://github.com/microsoft/PowerStig/issues/882) +* Update PowerSTIG to successfully parse/apply Microsoft Windows 2012 Server Domain Name System STIG - Ver 2, Rel 2 [#896](https://github.com/microsoft/PowerStig/issues/896) +* Update PowerSTIG to successfully parse/apply SQL Server 2016 Instance STIG- Ver 2, Rel 3 [#905](https://github.com/microsoft/PowerStig/issues/905) +* Update PowerSTIG to successfully parse/apply Microsoft Windows 2012 R2 MS STIG - Ver 3, Rel 2 [#900](https://github.com/microsoft/PowerStig/issues/900) +* Update PowerSTIG to successfully parse/apply Microsoft Windows Server 2016 DC/MS Ver 2, Rel 2: [#897](https://github.com/microsoft/PowerStig/issues/897) +* Update PowerSTIG to successfully parse/apply Microsoft Windows Server 2019 STIG - Ver 2, Rel 2: [#893](https://github.com/microsoft/PowerStig/issues/893) +* Update PowerSTIG to successfully parse/apply Red Hat Enterprise Linux 7 STIG - Ver 2, Rel 2: [#888](https://github.com/microsoft/PowerStig/issues/888) +* Update PowerSTIG to successfully parse/apply Microsoft IIS 8.5 SITE/SERVER STIG - V2R2: [#884](https://github.com/microsoft/PowerStig/issues/884) +* Update PowerSTIG to successfully parse/apply Google Chrome Ver 2, Rel 2: [#876](https://github.com/microsoft/PowerStig/issues/876) +* Update PowerSTIG to remove old rule Ids in Hard Coded Framework: [#864](https://github.com/microsoft/PowerStig/issues/864) +* Update PowerSTIG to successfully add SQL Server 2016 vulnerability IDs: [#872](https://github.com/microsoft/PowerStig/issues/872) +* Fixed: PowerShell v7 Fix: AccessControlDsc/RegistryAccessEntry & NTFSAccessEntry "AccessControlList" should be an Array +* Fixed: Validation test fail because TABs are found in Description Field [#878](https://github.com/microsoft/PowerStig/issues/878) + ## [4.8.0] - 2021-03-01 * Update PowerSTIG to remove old rule Ids in Hard Coded Framework: [#790](https://github.com/microsoft/PowerStig/issues/790) diff --git a/FILEHASH.md b/FILEHASH.md index 217596518..1eb1fcbc5 100644 --- a/FILEHASH.md +++ b/FILEHASH.md @@ -1,4 +1,4 @@ -# PowerSTIG File Hashes : Module Version 4.8.0 +# PowerSTIG File Hashes : Module Version 4.9.0 Hashes for **PowerSTIG** files are listed in the following table: @@ -14,26 +14,26 @@ Hashes for **PowerSTIG** files are listed in the following table: | FireFox-All-4.29.xml | 83D5D4F59C81316455AAA18FFE207768E13C78CEBE91DD7C633E38E675C8B878 | 48344 | | FireFox-All-5.1.org.default.xml | C945966A44DEE00C73906437983A9BE413F6012F7E796F127545317096170D61 | 305 | | FireFox-All-5.1.xml | 7221F60B2D2AF30F506229A4A4429F3D1BEFBE07122CA61132407F35AB0BBC7E | 47024 | -| Google-Chrome-2.1.org.default.xml | 6B0CD862F76C16A40C3CB20EADFBC6A9D789211B707CEA8AE8F5513ED5318AF7 | 1143 | -| Google-Chrome-2.1.xml | 0CCC64397468814DFDFE1B9BC93D2521979F1959FEF9621C4C240D88ED967A86 | 96838 | | Google-Chrome-2.2.org.default.xml | 6947F3E48884969D7E54A184A9F87BE2A4FA757FE80F451094B7A985B69F236B | 1138 | | Google-Chrome-2.2.xml | F921E974EDFA98FB3EC8EA9D243B93D18BFD8FFF5A136ACB9C877FB2F4D3680F | 96788 | -| IISServer-10.0-1.2.org.default.xml | CCE53579894CC3DCE929CB2782DC077B9BEF54D3DFDFAD0208DDD8092D2DAA86 | 440 | -| IISServer-10.0-1.2.xml | A4A5751B19B5BF1658B91D0BBA8DF405E35C9A28E84E6BE67CAD300C2AC9D131 | 131096 | +| Google-Chrome-2.3.org.default.xml | 6C79394EFACB71205A5E691C21D781FF08331DE0FD4F82CF067CF4E62775336C | 1009 | +| Google-Chrome-2.3.xml | 518612F920005359A99AB2192CA6B5A187E6154DEE8F0437F8C54E876625045C | 92699 | | IISServer-10.0-2.1.org.default.xml | D0460DE57ADDF6FACCE9288CAF5B059D8D9F223276985F2AC53E0DC894E225AA | 440 | | IISServer-10.0-2.1.xml | 44293CF4680B55AB2FC81113DDE3892F686C2E1E7B0C4666361516BB878CF870 | 133456 | -| IISServer-8.5-1.11.org.default.xml | D2B45974062E5C376E5088B318EC6E858954BCE33CCCCB60390824C058DC3D3D | 439 | -| IISServer-8.5-1.11.xml | 75B8A98823AC044D0BD68A66E6263D6FF7529DD54565660E0DA41DCC854587F1 | 132327 | +| IISServer-10.0-2.2.org.default.xml | E1722BA91961C65D8CE34C0C5C2590B3A817007CD8516DEA25D5E5FE0918CA79 | 440 | +| IISServer-10.0-2.2.xml | FD012A962DB4CEF91215EC810975C5EB06DFFA895F84EC6D0599A7D341137DD2 | 136851 | | IISServer-8.5-2.1.org.default.xml | 74430102C9E2D3140C8FEC42EF426F214D191A387E9E2FF8235648D9455530A8 | 440 | | IISServer-8.5-2.1.xml | BA5784FBB2E6936716ED86273DA34B11ACF508FC0B1A61AA9D5BE2A3DBC4D8D7 | 132957 | -| IISSite-10.0-1.2.org.default.xml | 881F5FACEC050D06B4FA949C641B930A38E54EFB831DA57C12D047F1C891C4BD | 1309 | -| IISSite-10.0-1.2.xml | 82D1D28315F2930CA49BFA486E9F996EDEE2396D694CD01D4EB0D88DEDD463EC | 115767 | +| IISServer-8.5-2.2.org.default.xml | 54E793CD066B36A7996A3A7BC7C56D1812917DEA3B291487B3C43019BEA01C0A | 440 | +| IISServer-8.5-2.2.xml | FDB1E200DC8A182EDBF6D0CED09D85292C642FA4F774882A092BDC203826C7D9 | 133233 | | IISSite-10.0-2.1.org.default.xml | 37D96FAD978E78F5E28FEDE958D033DF820464632C14699BE4BD349C11A6C601 | 1309 | | IISSite-10.0-2.1.xml | 43BBB8FFBFB08953639599362BA3D6663D1337C891E05A3E8516FB27D5EDA23F | 117801 | -| IISSite-8.5-1.11.org.default.xml | 1A76F1D9232E65679703886888A243072E84A65F6CF4EFE67D61E577EDA6644B | 1383 | -| IISSite-8.5-1.11.xml | A951C0E93FDD1EE15AD95B92928C4FCD10373CCEBD9AF1DC71179066EC1EA42B | 125081 | +| IISSite-10.0-2.2.org.default.xml | FC2E45C93292E79996C08ED16ADB73BA089493B99EC89C8C37D23808F7E7E180 | 1309 | +| IISSite-10.0-2.2.xml | 61747866DC13073C0C3A664F95127017FBE64E00591C76291875EA4E9EA99FDA | 117898 | | IISSite-8.5-2.1.org.default.xml | B0BA05F7D3FD430927B8924334F90851630DB326463635EAA1E08EB6B212362A | 1403 | | IISSite-8.5-2.1.xml | CAF8FE884C15BFE5F42CF624558925B97CF03C49FF61E4FA4842EA469484B58B | 127267 | +| IISSite-8.5-2.2.org.default.xml | D92C5880C7C9F50C49B1901339F479E53D6F8975B6FAE138FB988DF632223264 | 1403 | +| IISSite-8.5-2.2.xml | 508D54AAD8BF71ABEB3C3BA588746AEAF0613A7F2385E1D874469C7C7D6F57CF | 127420 | | InternetExplorer-11-1.18.org.default.xml | 1095CEEAD18CBBAD9068326B97D520F7F76F1F71331618F17B2138DC8FE55ED4 | 306 | | InternetExplorer-11-1.18.xml | 7AB1611E525B8D257E722BE7175898F76EAC1C3AFD592C15738AC7EB365139D4 | 332058 | | InternetExplorer-11-1.19.org.default.xml | 586CE903A5C77913C78DAB9129560E118D56C6F4AB3C7B0AEA2BC38F25EE54DB | 306 | @@ -44,6 +44,8 @@ Hashes for **PowerSTIG** files are listed in the following table: | MS-Edge-1.1.xml | 23E9417B15D5A6C6DC6774A0F919F631F6196F39B61C6660809312FA14D906C0 | 115483 | | Office-365ProPlus-2.1.org.default.xml | 7EB8E2CEE22A9B4757145A9191945182C9551769F74C5FD04AAFC8F1ECF61754 | 1793 | | Office-365ProPlus-2.1.xml | 602BE5E2599B09EA0B1C677D69C9C8E7D7048228651790F71D9A6404B83A0C48 | 374507 | +| Office-365ProPlus-2.2.org.default.xml | 4244041CE363AD7A4703DA868467A836D05310739A4D02F946F0D1974AFCE20A | 1792 | +| Office-365ProPlus-2.2.xml | 4253415862D42A0D2B677475412F245F55A698F61BC934824970E646B8768F45 | 374696 | | Office-Excel2013-1.7.org.default.xml | 6A8FBC7AD79015A5261C617A2EFC0084E58BCAFAAD3FA2B8E61BC01A860C102C | 429 | | Office-Excel2013-1.7.xml | D7A0C2FE798EA929BD40DF7FF27324FF8AF2F4C4BD412F9CD4B316A96406DDC0 | 108967 | | Office-Excel2016-1.2.org.default.xml | EE134DCD15DEFBD412AF18477F75248DE83A705E10CA061776F2AE74884749E3 | 530 | @@ -78,61 +80,63 @@ Hashes for **PowerSTIG** files are listed in the following table: | OracleJRE-8-2.1.xml | 34B2B1060088BD4A915B3F713464A636DCD98D6B8A32163F831A485F51DEC211 | 46312 | | RHEL-7-3.2.org.default.xml | 87B88EC8C08E223D7A47E03EEBEAB658375E605E5BB8E08C02531E8824DFA918 | 5457 | | RHEL-7-3.2.xml | 310718E4C4BCB69CC69E22EDB4FBDDE7D1D205711472987330B072B6C9FB2A8B | 687685 | +| RHEL-7-3.3.org.default.xml | 9DA25E0F64CA2657E319D5205643567DFEF32D540D67BA7763FAC52D214A16D7 | 5842 | +| RHEL-7-3.3.xml | F178A510170990E5E53BED0F09CE56612B6296DE54EC7A491F934DAEE081E1AE | 697162 | | SqlServer-2012-Database-1.19.org.default.xml | 68A05F4480CD66C7CB07BF7554A6FB580AD1D7826D56F3B399A164321A5904C5 | 409 | | SqlServer-2012-Database-1.19.xml | 73EBD394A734F4C66077BA9124FD69131986232BB8800EE88509D98CBC471FED | 85752 | | SqlServer-2012-Database-1.20.org.default.xml | 47313880BA67BB11CB86B59D2C380B429C6CF8E5C59CD888B3334AD6F015E525 | 409 | | SqlServer-2012-Database-1.20.xml | EF0C08AAD52F900B5B1BC6BEDB172F0B4BCBF6EC68603543EC865D0436F5DA9A | 85698 | | SqlServer-2012-Instance-1.19.org.default.xml | 9B26B9AFBF4300D9B66FE4A70D748E030F1F09B3C51D6D926A17A003A25EFC54 | 923 | -| SqlServer-2012-Instance-1.19.xml | 490C90ADBB579E83F54F886CCBC9D62976119925E8D426F18FD8AA8F35D5996C | 719134 | +| SqlServer-2012-Instance-1.19.xml | 49F29433267AEF455E2487F66939E606320B7117A9D27A161940E0CEB4F7A7F7 | 725009 | | SqlServer-2012-Instance-1.20.org.default.xml | BF4B54ECA57950AB1EB48D43454B7B6F11FBBE9992981031E3DD1AFC0F3B1C49 | 923 | -| SqlServer-2012-Instance-1.20.xml | 78A5834304516003F2946217A0690EF602784F4A8D8FEAE43433DB762465CCF7 | 711671 | -| SqlServer-2016-Instance-2.1.org.default.xml | 90B8C7718C06C930178B621218A629B44A4F18885F0B5816E06AC76E8A1DA329 | 305 | -| SqlServer-2016-Instance-2.1.xml | 4EEA00BFC5072FB2969EAB567DD6B8602841AE00E7A059A99F63698CCB50A3E6 | 466722 | +| SqlServer-2012-Instance-1.20.xml | 508E11187FEBD7E435A7DCC1741FDADCEC15DD3C072717FF0B09079B99D16FD2 | 717546 | | SqlServer-2016-Instance-2.2.org.default.xml | 7A8F784B74E6FA1575783B1849B258F4DD6B7CD87B165802CCA6A16839CCA5AD | 305 | -| SqlServer-2016-Instance-2.2.xml | C33CCB2FBD29837F6414E73650C9E4793972BC6D3FB1433A37B586AFE4B6CDAD | 466666 | +| SqlServer-2016-Instance-2.2.xml | C1DA03FFA28CC2865B0625E0107EF901E664563959CAD274A7F11F921F9DADDA | 470490 | +| SqlServer-2016-Instance-2.3.org.default.xml | 65560374E19492C3BBA42CC0A40AFC2F74C82AD01977E5061F41A4BCEDC2BF8E | 305 | +| SqlServer-2016-Instance-2.3.xml | B9DE3E6E6F1C486653E359163DECAE34CAEC2B3464F49E3223FFA5C9F8AE1E7D | 470514 | | Ubuntu-18.04-2.2.org.default.xml | 88E60212AB56AE2160D77555D1B9F4206C118467AA2768D070F5C5109FEC15AD | 6920 | | Ubuntu-18.04-2.2.xml | 79A666BDDBAE2D5040C07F11C3647795D142DBCE24DA4581473F8357F3C903A5 | 639037 | | Vsphere-6.5-1.4.org.default.xml | 0094C819CBDE50985DC324280712622E3ECAA46E45AFFFEAFB6C91A139B72627 | 791 | | Vsphere-6.5-1.4.xml | D78A4D1192D4D0836A6A3FC945F06D4DF3F9EB36F35141A4BED8DC401AEB71DE | 143136 | | Vsphere-6.5-2.1.org.default.xml | A3F800215D9EC75C5EA9EF02B1F01999EFFBC5D0EBD6C7626F448A366DDF101B | 797 | | Vsphere-6.5-2.1.xml | C4FDE5C57AE262ADD5BF94F968302CBC418932364930135CAB900B57D6224AEE | 144122 | -| WindowsClient-10-1.23.org.default.xml | 560C71F2C07DB76CB9B824D50FEFA2D50F59AF4379BD2EB13C75D091EAAF6382 | 4828 | -| WindowsClient-10-1.23.xml | 0C3EEA49B0A81C6A6DDD4CAC6273BDB539EDCC2F087DD5D4D71FA881C7836828 | 706835 | | WindowsClient-10-2.1.org.default.xml | 00E4C5DD37FA4AAA5C050F1FB2D04662541DF389040F2861EAA011E603256A74 | 4660 | | WindowsClient-10-2.1.xml | 6A2663CE9691A3F8812964008A0980647991611D0D568F64496F616A3E0122AC | 718398 | +| WindowsClient-10-2.2.org.default.xml | 1EC0DBEFCAE4C05A5B47787DA3D6A6284394EBDFF95EBB477756BDB5FF73F5C4 | 4660 | +| WindowsClient-10-2.2.xml | 700EA20B9C1B10E901BA84DA9D7CBFA0207D7BFBA42F51923F15514A4142C744 | 718991 | | WindowsDefender-All-1.8.org.default.xml | C9609DE449345A4BE63AACBEF2EE44689852811ED2D4845F426945C5ADE25897 | 1071 | | WindowsDefender-All-1.8.xml | F54DDC75434BF5CA58A57F2FC648A04F90FB7C0A6BC4C10B3BC00DFCF6BB71A5 | 94765 | | WindowsDefender-All-2.1.org.default.xml | 1B0F2EE7D068944E2B55187D9A45DC792CD38559DF888AFC8C6FF10B3A756770 | 1088 | | WindowsDefender-All-2.1.xml | 4A6538A6AD9E0ADF16D6A907DF0A12EAE44952BDCF383455C52A7E850FD8C45F | 96806 | -| WindowsDnsServer-2012R2-1.15.org.default.xml | B96A080974E42D51381B47C63FEB29F5DF91EDED3A44617945AC78A1D39E89D1 | 449 | -| WindowsDnsServer-2012R2-1.15.xml | F5881AF1DF6BD623F6C115DC059C8EEBA4F5175A0986F21322A268E8825D63FF | 268780 | | WindowsDnsServer-2012R2-2.1.org.default.xml | 693C53E7B2DCB367DA8119934BBC66C2FD78BFC764F4FC2A514FC00CB1C450F9 | 449 | | WindowsDnsServer-2012R2-2.1.xml | D5C639D871A9875C6AD4FFD0B5EF9C822FE9568827605E0C4D15AC185FD879F9 | 247159 | +| WindowsDnsServer-2012R2-2.2.org.default.xml | 7E3085E1D9F0F8021899FF9C31DD968D2A34240CCF0CF399DCC8C704C0BC55DA | 449 | +| WindowsDnsServer-2012R2-2.2.xml | E508A852446186156CA2222CC94A611AF8A57920424E04EA403E5E8DBA5C483C | 247177 | | WindowsFirewall-All-1.6.org.default.xml | 129A5B9F20B27E36FED4C1AC470B7B7419B563A6B2733B7FC3112CAF682ABB77 | 966 | | WindowsFirewall-All-1.6.xml | 42FA28D3C4BA6387D3EA4F5DCB72F133F814D3A9854555498E22DDFD188194B7 | 65518 | | WindowsFirewall-All-1.7.org.default.xml | 64E9FFA9B456C36DD36B5824BF641E473931B5C350F473DDFFDF31B1B64DD016 | 966 | | WindowsFirewall-All-1.7.xml | BBB13C6D675EB591D972EF8AD9B46472CFE80FCAD76E9D453586E6BE430F01B6 | 65518 | -| WindowsServer-2012R2-DC-2.21.org.default.xml | 283BBECBB51464093C4DAB666C7CEB3B6F42D7AF6F15D4067951D904287ECC9B | 5457 | -| WindowsServer-2012R2-DC-2.21.xml | D60C50447168DB56379E923BFBD9E925BF01C67B375E05031FA922917BB2FFBC | 789352 | | WindowsServer-2012R2-DC-3.1.org.default.xml | 1E6C3050BFC42B2F61D829F9C1EE40DCAA7335B9EE5AEF185CB69C4EE2765633 | 5596 | | WindowsServer-2012R2-DC-3.1.xml | 041488605D7E505B23C31A489150FDA8D3F74C5C9F0AC8A1794CB0477FC65FF1 | 784186 | -| WindowsServer-2012R2-MS-2.19.org.default.xml | AB13E75014B54356651DF9A790155B4BDE4D5A189EAF2BA5665635C667A27155 | 4913 | -| WindowsServer-2012R2-MS-2.19.xml | 888DE83E71766709BAC7BE4DCAD7E5C8479402D82A13995EBD42F3E1A3F73CD9 | 681744 | +| WindowsServer-2012R2-DC-3.2.org.default.xml | E3ACC79BFC3CB7BB8CAE95708EEC6372FDD46366CBF051F651AAA847666B9E7D | 5596 | +| WindowsServer-2012R2-DC-3.2.xml | B1FA63D7A9371F700F7FC31C942F899A38C9CA1816F6769947EA424BD2ADFA57 | 784489 | | WindowsServer-2012R2-MS-3.1.org.default.xml | D84032D248CC5D70C2D1CF24B86AAE02D73330FA1EC4E69249FC2C4A523883AD | 5026 | | WindowsServer-2012R2-MS-3.1.xml | B9CDB385084A257FCFCB07BCD853A79A0EC60F6B8D7535B7EAE04B29D445AB95 | 678770 | -| WindowsServer-2016-DC-1.12.org.default.xml | 7E29598C831A28FE0A94E566B448CF10D7A75AE82C7AFD7F5281067C777601BD | 4598 | -| WindowsServer-2016-DC-1.12.xml | 6FA88C2321461D8455BC28A2B977DFC1D2EDA8D1F585EB8B4F0DD60D1E1DD8DE | 550978 | +| WindowsServer-2012R2-MS-3.2.org.default.xml | 398CCB058FAF62B13639C57CC597A0061AF457EDF0459845325D4B60BA3B8001 | 5026 | +| WindowsServer-2012R2-MS-3.2.xml | FDF1216FF94C7209E8C023D26F33A436BA019951A0E2AB4E962F27C5421DB8E7 | 679149 | | WindowsServer-2016-DC-2.1.org.default.xml | B80069F4AEB52DB4CA7934E617A699A8F8D343E7EAC7DE1FF088CAAC6AF20602 | 4671 | | WindowsServer-2016-DC-2.1.xml | E6A62B787CFD6DB3A8AE3AAC17C08F856DB8B11F424DA1B81290B16607645DCC | 561489 | -| WindowsServer-2016-MS-1.12.org.default.xml | 6167494CE31CF938EBBB91FDEA24ABC05D11FA13294EFD1DEF36DB6ACF12EF5D | 4714 | -| WindowsServer-2016-MS-1.12.xml | 6A06D0C7B734A504F90F3FF7B33A44EEEFAA47C982FC891B46B6FD57171CEC65 | 473633 | +| WindowsServer-2016-DC-2.2.org.default.xml | 26B353AD3C3DF58C4B8286059E498BD79C6798AEFCDCBDE3B0B5811E38DA6A38 | 4671 | +| WindowsServer-2016-DC-2.2.xml | E74D24D5D2D485B48C5DDDD00BC2BDFAA327679CA6623765CCF1E7DFA794AAF4 | 560884 | | WindowsServer-2016-MS-2.1.org.default.xml | 183037554B06AD1FE437CA4569657759DAE1DC08FA46D886CC9310072952DD05 | 4783 | | WindowsServer-2016-MS-2.1.xml | 491E715367722D255D8F3DD3FFFA78F01514539B5FB236A8212A70139A924D65 | 483071 | -| WindowsServer-2019-DC-1.5.org.default.xml | 4C557728FC6957E8366F3FA61F9AF9B93097D17F768FA34D82EAE39472553DE0 | 4842 | -| WindowsServer-2019-DC-1.5.xml | 304B5E1F9AA02630E2FAAA260A89690B4C507428F787E32C5F5B9424A9F22343 | 835931 | +| WindowsServer-2016-MS-2.2.org.default.xml | 9D4BA15F661A33713857F416872D0D6FBCE5391D3D159E1B5E22B0AC55A5558E | 4783 | +| WindowsServer-2016-MS-2.2.xml | B728D8DD42DCF989513C78FBBFC3F5831711F14A5EFCC353C86E2E7E5DF575EB | 483263 | | WindowsServer-2019-DC-2.1.org.default.xml | 16E9FD633C5E0609DC83C6D3DF153E488647690323FFA6061342BD07156EA433 | 4770 | | WindowsServer-2019-DC-2.1.xml | E85327F42224EE1971BD93F0A4559A7444275587B8429BB630A4D73F9DBA6646 | 852477 | -| WindowsServer-2019-MS-1.5.org.default.xml | C66E670220BE21B939CE7323C3E2F65281C0A1627229EF1B03F196D62AB16054 | 4780 | -| WindowsServer-2019-MS-1.5.xml | 9031353E5A070FAD5CF136AB366924D5C0DAF16077D4882E10CE3496E5DDA788 | 758317 | +| WindowsServer-2019-DC-2.2.org.default.xml | 48D96ED6ACF4D9D5B3A83A3362DCCB228CE02E16379C916BBFA7886EA2873008 | 4770 | +| WindowsServer-2019-DC-2.2.xml | 11F7719DD69076BA94B4156BB8389671716D5B2726021B53F8BC50125A11893A | 851830 | | WindowsServer-2019-MS-2.1.org.default.xml | FA3161D5757A0851C663F2F04596D9964D5BE756113F0691C608497D02C09914 | 4702 | | WindowsServer-2019-MS-2.1.xml | 292FD9BE31D1D3C51DE91C2F2967225D327455FB612A850D3E489BD9499382DB | 773888 | +| WindowsServer-2019-MS-2.2.org.default.xml | C8CEE6948453854A84122D82D2B852E883245D4B0857833B4C77AD1459CE6DA4 | 4702 | +| WindowsServer-2019-MS-2.2.xml | 0CED5D91BBE09174B38E504F193D6AB15F232AF1C805EFB08EC22366D56A523F | 774039 | diff --git a/README.md b/README.md index d913c26d3..b337a0c57 100644 --- a/README.md +++ b/README.md @@ -110,6 +110,7 @@ We are especially thankful for those who have contributed pull requests to the c ### Contributors +* [@addavenp1](https://github.com/addavenp1) (Adam Davenport) * [@ALichtenberg](https://github.com/ALichtenberg) (Adam Lichtenberg) * [@athaynes](https://github.com/athaynes) (Adam Haynes) * [@bcwilhite](https://github.com/bcwilhite) (Brian Wilhite) diff --git a/Tests/Integration/Module/SqlServerConfigurationRule.Integration.tests.ps1 b/Tests/Integration/Module/SqlServerConfigurationRule.Integration.tests.ps1 new file mode 100644 index 000000000..8d27fb423 --- /dev/null +++ b/Tests/Integration/Module/SqlServerConfigurationRule.Integration.tests.ps1 @@ -0,0 +1,240 @@ +#region Header +. $PSScriptRoot\.tests.header.ps1 +#endregion + +try +{ + $testStrings = @( + @{ + OptionName = 'xp_cmdshell' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. + + To determine if xp_cmdshell is enabled, execute the following commands: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''xp_cmdshell''; + + If the value of "config_value" is "0", this is not a finding. + + Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.' + }, + @{ + OptionName = 'clr enabled' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. + + To determine if CLR is enabled, execute the following commands: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''clr enabled''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. + + If CLR code is approved, check the database for UNSAFE assembly permission using the following script: + + USE [master] + SELECT * + FROM sys.assemblies + WHERE permission_set_desc != ''SAFE'' + AND is_user_defined = 1; + + If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.' + }, + @{ + OptionName = 'common criteria compliance enabled' + OptionValue = '1' + OrganizationValueRequired = $false + CheckContent = 'Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. + + SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. + + Review the Instance configuration: + + + SELECT value_in_use + FROM sys.configurations + WHERE name = ''common criteria compliance enabled'' + + If "value_in_use" is set to "1" this is not a finding. + If "value_in_use" is set to "0" this is a finding. + + NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding.' + }, + @{ + OptionName = 'filestream access level' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'Review the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. + + If FileStream is not documented as being authorized, execute the following query. + EXEC sp_configure ''filestream access level'' + + If "run_value" is greater than "0", this is a finding. + + + + This rule checks that Filestream SQL specific option is disabled. + + SELECT CASE + WHEN EXISTS (SELECT * + FROM sys.configurations + WHERE Name = ''filestream access level'' + AND Cast(value AS INT) = 0) THEN ''No'' + ELSE ''Yes'' + END AS TSQLFileStreamAccess; + + If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.' + }, + @{ + OptionName = 'Ole Automation Procedures' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Ole Automation Procedures" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''Ole Automation Procedures''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'user options' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "User Options" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''user options''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'remote access' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Remote Access" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''remote access''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'hadoop connectivity' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Hadoop Connectivity" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''hadoop connectivity''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'allow polybase export' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Allow Polybase Export" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''allow polybase export''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'remote data archive' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Remote Data Archive" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''remote data archive''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'external scripts enabled' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "External Scripts Enabled" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''external scripts enabled''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'replication xps' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if the "Replication Xps" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''replication xps''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding.' + } + ) + + Describe 'SQL Server Configuration Conversion' { + + foreach ($testString in $testStrings) + { + [xml] $stigRule = Get-TestStigRule -CheckContent $testString.CheckContent -XccdfTitle Windows + $TestFile = Join-Path -Path $TestDrive -ChildPath 'TextData.xml' + $stigRule.Save($TestFile) + $rule = ConvertFrom-StigXccdf -Path $TestFile + + It 'Should return an SQLServerConfigurationRule Object' { + $rule.GetType() | Should Be 'SqlServerConfigurationRule' + } + + It "Should set Option Name to '$($testString.Name)'" { + $rule.OptionName | Should Be $testString.OptionName + } + + It 'Should Set the status to pass' { + $rule.conversionstatus | Should Be 'pass' + } + + It 'Should set the correct DscResource' { + $rule.DscResource | Should Be 'SQLServerConfiguration' + } + } + } +} + +finally +{ + . $PSScriptRoot\.tests.footer.ps1 +} diff --git a/Tests/Unit/Module/SqlServerConfigurationRule.tests.ps1 b/Tests/Unit/Module/SqlServerConfigurationRule.tests.ps1 new file mode 100644 index 000000000..24ba74c8d --- /dev/null +++ b/Tests/Unit/Module/SqlServerConfigurationRule.tests.ps1 @@ -0,0 +1,248 @@ +#region Header +. $PSScriptRoot\.tests.header.ps1 +#endregion + +try +{ + InModuleScope -ModuleName "$($global:moduleName).Convert" { + #region Test Setup + $testRuleList = @( + @{ + OptionName = 'xp_cmdshell' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. + + To determine if xp_cmdshell is enabled, execute the following commands: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''xp_cmdshell''; + + If the value of "config_value" is "0", this is not a finding. + + Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.' + }, + @{ + OptionName = 'clr enabled' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. + + To determine if CLR is enabled, execute the following commands: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''clr enabled''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. + + If CLR code is approved, check the database for UNSAFE assembly permission using the following script: + + USE [master] + SELECT * + FROM sys.assemblies + WHERE permission_set_desc != ''SAFE'' + AND is_user_defined = 1; + + If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.' + }, + @{ + OptionName = 'common criteria compliance enabled' + OptionValue = '1' + OrganizationValueRequired = $false + CheckContent = 'Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. + + SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. + + Review the Instance configuration: + + + SELECT value_in_use + FROM sys.configurations + WHERE name = ''common criteria compliance enabled'' + + If "value_in_use" is set to "1" this is not a finding. + If "value_in_use" is set to "0" this is a finding. + + NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding.' + }, + @{ + OptionName = 'filestream access level' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'Review the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. + + If FileStream is not documented as being authorized, execute the following query. + EXEC sp_configure ''filestream access level'' + + If "run_value" is greater than "0", this is a finding. + + + + This rule checks that Filestream SQL specific option is disabled. + + SELECT CASE + WHEN EXISTS (SELECT * + FROM sys.configurations + WHERE Name = ''filestream access level'' + AND Cast(value AS INT) = 0) THEN ''No'' + ELSE ''Yes'' + END AS TSQLFileStreamAccess; + + If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.' + }, + @{ + OptionName = 'Ole Automation Procedures' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Ole Automation Procedures" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''Ole Automation Procedures''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'user options' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "User Options" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''user options''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'remote access' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Remote Access" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''remote access''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'hadoop connectivity' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Hadoop Connectivity" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''hadoop connectivity''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'allow polybase export' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Allow Polybase Export" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''allow polybase export''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'remote data archive' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "Remote Data Archive" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''remote data archive''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'external scripts enabled' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if "External Scripts Enabled" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''external scripts enabled''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding.' + }, + @{ + OptionName = 'replication xps' + OptionValue = '0' + OrganizationValueRequired = $false + CheckContent = 'To determine if the "Replication Xps" option is enabled, execute the following query: + + EXEC SP_CONFIGURE ''show advanced options'', ''1''; + RECONFIGURE WITH OVERRIDE; + EXEC SP_CONFIGURE ''replication xps''; + + If the value of "config_value" is "0", this is not a finding. + + If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding.' + } + ) + #endregion + + foreach ($testRule in $testRuleList) + { + . $PSScriptRoot\Convert.CommonTests.ps1 + } + + #region Add Custom Tests Here + Describe 'Method Function Tests' { + foreach ($testRule in $testRuleList) + { + + $optionName = Get-OptionName -CheckContent $testRule.CheckContent + + Context "SqlServerConfiguration Get-OptionName"{ + It "Should return $($optionName)" { + $optionName | Should Be $testrule.OptionName + } + } + + $optionValue = Set-OptionValue -CheckContent $testRule.CheckContent + + Context "SqlServerConfiguration Set-OptionValue" { + It "Should return $($optionValue)" { + $optionValue | Should Be $testrule.OptionValue + } + } + + . $PSScriptRoot\Convert.CommonTests.ps1 + + } + } + } +} + +finally +{ + . $PSScriptRoot\.tests.footer.ps1 +} diff --git a/build.yaml b/build.yaml index c039f1d53..ffd238ab4 100644 --- a/build.yaml +++ b/build.yaml @@ -67,8 +67,9 @@ DscTest: Tag: ExcludeSourceFile: - output + - StigData/Archive # added to ignore orginal DISA STIG files duiring HQRM test due to TAB's causing test failure ExcludeModuleFile: - + - StigData/Archive # added to ignore orginal DISA STIG files duiring HQRM test due to TAB's causing test failure Resolve-Dependency: Gallery: 'PSGallery' AllowPrerelease: false diff --git a/source/DSCResources/Resources/SqlServer.SQLServerConfiguration.ps1 b/source/DSCResources/Resources/SqlServer.SQLServerConfiguration.ps1 new file mode 100644 index 000000000..faa9341c3 --- /dev/null +++ b/source/DSCResources/Resources/SqlServer.SQLServerConfiguration.ps1 @@ -0,0 +1,30 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. + +$Rules = $Stig.RuleList | Select-Rule -Type SqlServerConfigurationRule + +# Sets variables for Default and Named Instances. +foreach ($instance in $serverInstance) +{ + if ($instance -notmatch '\\') + { + $instanceName = 'MSSQLSERVER' + $serverName = $instance + } + else + { + $instanceName = $instance.Split('{\}')[1] + $serverName = $instance.Split('{\}')[0] + } + + foreach ($rule in $rules) + { + SqlServerConfiguration (Get-ResourceTitle -Rule $rule) + { + InstanceName = $instanceName + ServerName = $serverName + OptionName = $rule.OptionName + OptionValue = $rule.OptionValue + } + } +} diff --git a/source/DSCResources/Resources/windows.AccessControl.ps1 b/source/DSCResources/Resources/windows.AccessControl.ps1 index 11f0cdc65..3e30c3c27 100644 --- a/source/DSCResources/Resources/windows.AccessControl.ps1 +++ b/source/DSCResources/Resources/windows.AccessControl.ps1 @@ -16,8 +16,7 @@ foreach ($rule in $rules) { Path = $rule.Path Force = $ruleForce - AccessControlList = $( - + AccessControlList = @( foreach ($acentry in $rule.AccessControlEntry.Entry) { $aceEntryForcePrincipal = $null @@ -67,7 +66,7 @@ foreach ($rule in $rules) { Path = $rule.Path Force = $ruleForce - AccessControlList = $( + AccessControlList = @( foreach ($acentry in $rule.AccessControlEntry.Entry) { $aceEntryForcePrincipal = $null diff --git a/source/DSCResources/SqlServer/SqlServer.schema.psm1 b/source/DSCResources/SqlServer/SqlServer.schema.psm1 index e09c10f8c..693838b90 100644 --- a/source/DSCResources/SqlServer/SqlServer.schema.psm1 +++ b/source/DSCResources/SqlServer/SqlServer.schema.psm1 @@ -99,6 +99,7 @@ configuration SqlServer Import-DscResource -ModuleName SqlServerDsc -ModuleVersion 13.3.0 . "$resourcePath\SqlServer.ScriptQuery.ps1" + . "$resourcePath\SqlServer.SQLServerConfiguration.ps1" Import-DscResource -ModuleName SecurityPolicyDsc -ModuleVersion 2.10.0.0 . "$resourcePath\Windows.SecurityOption.ps1" diff --git a/source/Module/Common/Convert/Data.ps1 b/source/Module/Common/Convert/Data.ps1 index 43510550b..8c84db70c 100644 --- a/source/Module/Common/Convert/Data.ps1 +++ b/source/Module/Common/Convert/Data.ps1 @@ -106,5 +106,7 @@ data exclusionRuleList V-235722 = 'Edge: Rule requires an unknown list and count of whitelisted domains, unable to automate rule' V-235753 = 'Edge: Rule requires an unknown list and count of whitelisted domains, unable to automate rule' V-235755 = 'Edge: Rule requires an unknown list and count of whitelisted extensions, unable to automate rule' + V-218827 = 'IIS 10 Rule , unable to automate rule' + V-241789 = 'IIS 10 Rule , unable to automate rule' '@ } diff --git a/source/Module/Common/Functions.XccdfXml.ps1 b/source/Module/Common/Functions.XccdfXml.ps1 index 6d1c46c7e..b164aec61 100644 --- a/source/Module/Common/Functions.XccdfXml.ps1 +++ b/source/Module/Common/Functions.XccdfXml.ps1 @@ -176,6 +176,9 @@ function Get-StigRuleList { foreach ($stigRule in $StigGroupList) { + #Replace TAB's from in Rules to 3 spaces + $stigRule.rule.Check.('check-content') = $stigRule.rule.Check.('check-content') -replace("`t"," ") + # This is to address STIG Rule V-18395 that has multiple rules that are exactly the same under that rule ID. if ($stigRule.Rule.Count -gt 1) { diff --git a/source/Module/Rule.SqlServerConfiguration/Convert/Methods.ps1 b/source/Module/Rule.SqlServerConfiguration/Convert/Methods.ps1 new file mode 100644 index 000000000..48226896c --- /dev/null +++ b/source/Module/Rule.SqlServerConfiguration/Convert/Methods.ps1 @@ -0,0 +1,74 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. +#region Method Functions +<# + .SYNOPSIS + Retrieves the SqlServerConfiguration OptionName from the check-content element in the xccdf + + .PARAMETER CheckContent + Specifies the check-content element in the xccdf +#> +function Get-OptionName +{ + [CmdletBinding()] + [OutputType([string])] + param + ( + [Parameter(Mandatory = $true)] + [string] + $CheckContent + ) + + switch ($checkcontent) + { + {$PSItem -Match "(?<=EXEC SP_CONFIGURE\s').+?(?=')"} + { + $optionName = ($PSItem | Select-String -Pattern "(?<=EXEC SP_CONFIGURE\s').+?(?=')" -AllMatches).Matches[1] + } + {$PSItem -Match "WHERE name = 'common criteria compliance enabled'"} + { + $optionName = "common criteria compliance enabled" + } + {$PSItem -Match "EXEC sp_configure 'filestream access level'"} + { + $optionName = "filestream access level" + } + } + + return $optionName +} + +<# + .SYNOPSIS + Sets the SqlServerConfiguration OptionValue from the check-content element in the xccdf + + .PARAMETER CheckContent + Specifies the check-content element in the xccdf +#> +function Set-OptionValue +{ + [CmdletBinding()] + [OutputType([string])] + param + ( + [Parameter(Mandatory = $true)] + [string] + $CheckContent + ) + + # STIG guidance states most configuration options should be disabled unless required. Default state is set to disable. + + switch ($checkContent) + { + {$PSItem -Match "WHERE name = 'common criteria compliance enabled'"} + { + $optionValue = "1" + } + default + { + $optionValue = "0" + } + } + + return $optionValue +} diff --git a/source/Module/Rule.SqlServerConfiguration/Convert/SqlServerConfigurationRule.Convert.psm1 b/source/Module/Rule.SqlServerConfiguration/Convert/SqlServerConfigurationRule.Convert.psm1 new file mode 100644 index 000000000..51dc2f2d1 --- /dev/null +++ b/source/Module/Rule.SqlServerConfiguration/Convert/SqlServerConfigurationRule.Convert.psm1 @@ -0,0 +1,118 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. +using module .\..\..\Common\Common.psm1 +using module .\..\..\Rule\Rule.psm1 +using module .\..\SqlServerConfigurationRule.psm1 + +$exclude = @($MyInvocation.MyCommand.Name,'Template.*.txt') +$supportFileList = Get-ChildItem -Path $PSScriptRoot -Exclude $exclude +foreach ($supportFile in $supportFileList) +{ + Write-Verbose "Loading $($supportFile.FullName)" + . $supportFile.FullName +} + +# Header + +<# + .SYNOPSIS + Convert the contents of an xccdf check-content element into a SqlServerConfigurationRule + .DESCRIPTION + The SqlServerConfigurationRule class is used to extract the vulnerability ID's that can + be set with the SqlServerDsc module from the check-content of the xccdf. + Once a STIG rule is identified a SqlServerDsc rule, it is passed to the SqlServerConfigurationRule + class for parsing and validation. +#> + +class SqlServerConfigurationRuleConvert : SqlServerConfigurationRule +{ + <# + .SYNOPSIS + Empty constructor for SplitFactory + #> + SqlServerConfigurationRuleConvert () + { + } + + <# + .SYNOPSIS + Converts a xccdf stig rule element into a SqlServerConfiguration Rule + .PARAMETER XccdfRule + The STIG rule to convert + #> + + SqlServerConfigurationRuleConvert ([xml.xmlelement] $XccdfRule) : base ($XccdfRule, $true) + { + $this.SetOptionName() + $this.SetOptionValue() + $this.SetDscResource() + } + + #region Methods + + <# + .SYNOPSIS + Extracts the mitigation target name from the check-content and sets + the value + .DESCRIPTION + Gets the mitigation target name from the xccdf content and sets the + value. If the mitigation target name that is returned is not valid, + the parser status is set to fail + #> + + [void] SetOptionName () + { + $thisOptionName = Get-OptionName -CheckContent $this.RawString + + if (-not $this.SetStatus($thisOptionName)) + { + $this.set_OptionName($thisOptionName) + } + } + + [void] SetOptionValue () + { + $thisOptionValue = Set-OptionValue -CheckContent $this.rawstring + + if (-not $this.SetStatus($thisOptionValue)) + { + $this.set_OptionValue($thisOptionValue) + } + } + + static [bool] Match ([string] $CheckContent) + { + if + ( + $CheckContent -Match "EXEC SP_CONFIGURE 'xp_cmdshell';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'clr enabled';" -or + $CheckContent -Match "WHERE name = 'common criteria compliance enabled'" -or + $CheckContent -Match "EXEC sp_configure 'filestream access level'" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'Ole Automation Procedures';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'user options';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'remote access';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'hadoop connectivity';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'allow polybase export';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'remote data archive';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'external scripts enabled';" -or + $CheckContent -Match "EXEC SP_CONFIGURE 'replication xps';" + ) + { + return $true + } + + return $false + } + + hidden [void] SetDscResource () + { + if ($null -eq $this.DuplicateOf) + { + $this.DscResource = 'SqlServerConfiguration' + } + else + { + $this.DscResource = 'None' + } + } +} diff --git a/source/Module/Rule.SqlServerConfiguration/SqlServerConfigurationRule.psm1 b/source/Module/Rule.SqlServerConfiguration/SqlServerConfigurationRule.psm1 new file mode 100644 index 000000000..252f78698 --- /dev/null +++ b/source/Module/Rule.SqlServerConfiguration/SqlServerConfigurationRule.psm1 @@ -0,0 +1,66 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. +using module .\..\Common\Common.psm1 +using module .\..\Rule\Rule.psm1 +#header + +<# + .SYNOPSIS + SQL Server configuration option rule + .DESCRIPTION + The SqlServerConfigurationRule class is used to maange the Account Policy Settings. + .PARAMETER OptionName + The SQL Server configuration option name + .PARAMETER OptionValue + The SQL Server configuration option value + .PARAMETER Ensure + The ensure property +#> +class SqlServerConfigurationRule : Rule +{ + [string] $OptionName + [string] $OptionValue <#(ExceptionValue)#> + [string] $Ensure + + <# + .SYNOPSIS + Default constructor to support the AsRule cast method + #> + SqlServerConfigurationRule () + { + } + + <# + .SYNOPSIS + Used to load PowerSTIG data from the processed data directory + .PARAMETER Rule + The STIG rule to load + #> + SqlServerConfigurationRule ([xml.xmlelement] $Rule) : base ($Rule) + { + } + + <# + .SYNOPSIS + The Convert child class constructor + .PARAMETER Rule + The STIG rule to convert + .PARAMETER Convert + A simple bool flag to create a unique constructor signature + #> + SqlServerConfigurationRule ([xml.xmlelement] $Rule, [switch] $Convert) : base ($Rule, $Convert) + { + } + + <# + .SYNOPSIS + Creates class specifc help content + #> + [PSObject] GetExceptionHelp() + { + return @{ + Value = "15" + Notes = "Allowed values are per specific SQL Server Configuration setting. Refer to SQL Server documentation for allowed values." + } + } +} diff --git a/source/Module/Rule/Convert/ConvertFactory.psm1 b/source/Module/Rule/Convert/ConvertFactory.psm1 index 7302d4565..2d56a2169 100644 --- a/source/Module/Rule/Convert/ConvertFactory.psm1 +++ b/source/Module/Rule/Convert/ConvertFactory.psm1 @@ -38,6 +38,7 @@ using module .\..\..\Rule.nxService\Convert\nxServiceRule.Convert.psm1 using module .\..\..\Rule.nxFileLine\Convert\nxFileLineRule.Convert.psm1 using module .\..\..\Rule.nxFile\Convert\nxFileRule.Convert.psm1 using module .\..\..\Rule.RootCertificate\Convert\RootCertificateRule.Convert.psm1 +using module .\..\..\Rule.SqlServerConfiguration\Convert\SqlServerConfigurationRule.Convert.psm1 # Header @@ -216,6 +217,12 @@ class ConvertFactory [SqlScriptQueryRuleConvert]::new($Rule).AsRule() ) } + {[SQLServerConfigurationRuleConvert]::Match($PSItem)} + { + $null = $ruleTypeList.Add( + [SQLServerConfigurationRuleConvert]::new($Rule).AsRule() + ) + } {[UserRightRuleConvert]::Match($PSItem)} { $null = $ruleTypeList.AddRange( diff --git a/source/Module/Rule/Rule.LoadFactory.psm1 b/source/Module/Rule/Rule.LoadFactory.psm1 index dfd724cea..634088b49 100644 --- a/source/Module/Rule/Rule.LoadFactory.psm1 +++ b/source/Module/Rule/Rule.LoadFactory.psm1 @@ -34,6 +34,7 @@ using module .\..\Rule.nxService\nxServiceRule.psm1 using module .\..\Rule.nxFileLine\nxFileLineRule.psm1 using module .\..\Rule.nxFile\nxFileRule.psm1 using module .\..\Rule.RootCertificate\RootCertificateRule.psm1 +using module .\..\Rule.SqlServerConfiguration\SqlServerConfigurationRule.psm1 #header class LoadFactory @@ -79,6 +80,7 @@ class LoadFactory 'nxFileLineRule' {$return = [nxFileLineRule]::new($Rule)} 'nxFileRule' {$return = [nxFileRule]::new($Rule)} 'RootCertificateRule' {$return = [RootCertificateRule]::new($Rule)} + 'SqlServerConfigurationRule' {$return = [SqlServerConfigurationRule]::new($Rule)} } return $return diff --git a/source/Module/STIG/Convert/Data.ps1 b/source/Module/STIG/Convert/Data.ps1 index ad5d502f0..40fc384f7 100644 --- a/source/Module/STIG/Convert/Data.ps1 +++ b/source/Module/STIG/Convert/Data.ps1 @@ -54,5 +54,6 @@ data dscResourceModule nxFileRule = nx nxPackageRule = nx nxServiceRule = nx + SqlServerConfigurationRule = SqlServerDsc '@ } diff --git a/source/Module/STIG/Convert/Functions.PowerStigXml.ps1 b/source/Module/STIG/Convert/Functions.PowerStigXml.ps1 index 0ca592429..ae58be69f 100644 --- a/source/Module/STIG/Convert/Functions.PowerStigXml.ps1 +++ b/source/Module/STIG/Convert/Functions.PowerStigXml.ps1 @@ -339,6 +339,9 @@ function ConvertTo-PowerStigXml # Add the STIG details to the xml document. foreach ( $rule in $rules ) { + # Replace TAB(s) with 3 spaces in rule.description before adding to xml document. + $rule.Description = $rule.Description -replace("`t"," ") + [System.XML.XMLElement] $xmlRuleTypeProperty = $xmlDocument.CreateElement( 'Rule' ) # Append as child to an existing node. DO NOT remove the [void] [void] $xmlRuleType.appendChild( $xmlRuleTypeProperty ) diff --git a/source/PowerStig.Convert.psm1 b/source/PowerStig.Convert.psm1 index e52cd95cf..3fd5c8742 100644 --- a/source/PowerStig.Convert.psm1 +++ b/source/PowerStig.Convert.psm1 @@ -47,6 +47,7 @@ using module .\Module\Rule.nxService\Convert\nxServiceRule.Convert.psm1 using module .\Module\Rule.nxFileLine\Convert\nxFileLineRule.Convert.psm1 using module .\Module\Rule.nxFile\Convert\nxFileRule.Convert.psm1 using module .\Module\Rule.RootCertificate\Convert\RootCertificateRule.Convert.psm1 +using module .\Module\Rule.SqlServerConfiguration\Convert\SqlServerConfigurationRule.Convert.psm1 # load the public functions foreach ($supportFile in ( Get-ChildItem -Path "$PSScriptRoot\Module\Stig\Convert" -Recurse -Filter '*.ps1' -Exclude 'Data.*.ps1' ) ) diff --git a/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R1_Manual-xccdf.log b/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R3_Manual-xccdf.log similarity index 88% rename from source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R1_Manual-xccdf.log rename to source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R3_Manual-xccdf.log index 3cdf176e1..4222ac3bc 100644 --- a/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R1_Manual-xccdf.log +++ b/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R3_Manual-xccdf.log @@ -4,11 +4,11 @@ V-221582::3. If this key "DefaultPluginsSetting"::3. If the "DefaultPluginsSetti V-221597::3. If the “::3. If the " V-221599::3. If the key "DeveloperToolsAvailability"::3. If the "DeveloperToolsAvailability" value name V-221596::3. If the “AutoplayWhitelist” key::If the "AutoplayWhitelist" value name -V-221563::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallWhitelist'; ValueName = 'ExtensionInstallWhitelist'; ValueType = 'MultiString'; ValueData = $null; OrganizationValueTestString = "{0} -eq '1 | oiigbmnaadbkfbmpbfijlflahbdbdgdf | a list of administrator-approved extension IDs'"} +V-221563::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallAllowlist'; ValueName = '1'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "{0} -eq 'oiigbmnaadbkfbmpbfijlflahbdbdgdf | a list of administrator-approved extension IDs'"} V-221564::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'DefaultSearchProviderName'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "{0} -eq 'an organization approved encrypted search provider'"} V-221565::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'DefaultSearchProviderSearchURL'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "{0} -eq 'an organization-approved encrypted search string'"} V-221585::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'PluginsAllowedForUrls'; ValueType = 'MultiString'; ValueData = $null; OrganizationValueTestString = "{0} -eq 'a list of administrator approved URLs'"} V-221588::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'DownloadRestrictions'; ValueType = 'Dword'; ValueData = $null; OrganizationValueTestString = "{0} -eq '1|2'"} V-221596::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'AutoplayWhitelist'; ValueType = 'MultiString'; ValueData = $null; OrganizationValueTestString = "{0} -eq 'a list of administrator-approved URLs"} -V-221589::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'SSLVersionMin'; ValueType = 'String'; ValueData = 'tls1.1'} V-221583::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Absent'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls'} +V-234701::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome'; ValueName = 'SSLVersionMin'; ValueType = 'String'; ValueData = 'tls1.2'} diff --git a/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R1_Manual-xccdf.xml b/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R3_Manual-xccdf.xml similarity index 69% rename from source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R1_Manual-xccdf.xml rename to source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R3_Manual-xccdf.xml index fdae97e93..fbd36482e 100644 --- a/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R1_Manual-xccdf.xml +++ b/source/StigData/Archive/Chrome/U_Google_Chrome_STIG_V2R3_Manual-xccdf.xml @@ -1,4 +1,4 @@ -acceptedGoogle Chrome Current Windows Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 23 Oct 20203.1.1.362251.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000039<GroupDescription></GroupDescription>DTBC-0001Firewall traversal from remote host must be disabled.<VulnDiscussion>Remote connections should never be allowed that bypass the firewall, as there is no way to verify if they can be trusted. Enables usage of STUN and relay servers when remote clients are trying to establish a connection to this machine. If this setting is enabled, then remote clients can discover and connect to this machine even if they are separated by a firewall. If this setting is disabled and outgoing UDP connections are filtered by the firewall, then this machine will only allow connections from client machines within the local network. If this policy is left not set the setting will be enabled. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44711SV-57545CCI-001414Windows group policy: +acceptedGoogle Chrome Current Windows Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 3 Benchmark Date: 23 Apr 20213.2.2.360791.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000039<GroupDescription></GroupDescription>DTBC-0001Firewall traversal from remote host must be disabled.<VulnDiscussion>Remote connections should never be allowed that bypass the firewall, as there is no way to verify if they can be trusted. Enables usage of STUN and relay servers when remote clients are trying to establish a connection to this machine. If this setting is enabled, then remote clients can discover and connect to this machine even if they are separated by a firewall. If this setting is disabled and outgoing UDP connections are filtered by the firewall, then this machine will only allow connections from client machines within the local network. If this policy is left not set the setting will be enabled. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57545V-44711CCI-001414Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative\Templates\Google\Google Chrome\Configure remote access options Policy Name: Enable firewall traversal from remote access host @@ -13,10 +13,10 @@ Windows registry: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the RemoteAccessHostFirewallTraversal value name does not exist or its value data is not set to 0, then this is a finding. -SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0002Site tracking users location must be disabled.<VulnDiscussion>Website tracking is the practice of gathering information as to which websites were accesses by a browser. The common method of doing this is to have a website create a tracking cookie on the browser. If the information of what sites are being accessed is made available to unauthorized persons, this violates confidentiality requirements, and over time poses a significant OPSEC issue. This policy setting allows you to set whether websites are allowed to track the user’s physical location. Tracking the user’s physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location. - 1 = Allow sites to track the user’s physical location - 2 = Do not allow any site to track the user’s physical location - 3 = Ask whenever a site wants to track the user’s physical location</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44723SV-57557CCI-001166Windows group policy: +SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0002Site tracking users location must be disabled.<VulnDiscussion>Website tracking is the practice of gathering information as to which websites were accesses by a browser. The common method of doing this is to have a website create a tracking cookie on the browser. If the information of what sites are being accessed is made available to unauthorized persons, this violates confidentiality requirements, and over time poses a significant OPSEC issue. This policy setting allows you to set whether websites are allowed to track the user’s physical location. Tracking the user’s physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location. + 1 = Allow sites to track the user’s physical location + 2 = Do not allow any site to track the user’s physical location + 3 = Ask whenever a site wants to track the user’s physical location</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57557V-44723CCI-001166Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Default geolocation setting @@ -31,16 +31,16 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultGeolocationSetting value name does not exist or its value data is not set to 2, then this is a finding. -SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0004Sites ability to show pop-ups must be disabled.<VulnDiscussion>Chrome allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you disable this policy setting, scripts can continue to create pop-up windows, and pop-ups that hide other windows. Recommend configuring this setting to ‘2’ to help prevent malicious websites from controlling the pop-up windows or fooling users into clicking on the wrong window. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. If this policy is left not set, 'BlockPopups' will be used and the user will be able to change it. +SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0004Sites ability to show pop-ups must be disabled.<VulnDiscussion>Chrome allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you disable this policy setting, scripts can continue to create pop-up windows, and pop-ups that hide other windows. Recommend configuring this setting to ‘2’ to help prevent malicious websites from controlling the pop-up windows or fooling users into clicking on the wrong window. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. If this policy is left not set, 'BlockPopups' will be used and the user will be able to change it. 1 = Allow all sites to show pop-ups - 2 = Do not allow any site to show pop-ups</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44719SV-57553CCI-000381Windows group policy: + 2 = Do not allow any site to show pop-ups</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57553V-44719CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Default popups setting Policy State: Enabled Policy Value: Do not allow any site to show popups -Universal method: +Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DefaultPopupsSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding. @@ -49,37 +49,33 @@ Windows method: 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the value name DefaultPopupsSetting does not exist or its value data is not set to 2, then this is a finding. -Note: If AO Approved exceptions to this rule have been enabled, this is not a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0005Extensions installation must be blacklisted by default.<VulnDiscussion>Extensions are developed by third party sources and are designed to extend Google Chrome's functionality. An extension can be made by anyone, to do and access almost anything on a system; this means they pose a high risk to any system that would allow all extensions to be installed by default. Allows you to specify which extensions the users can NOT install. Extensions already installed will be removed if blacklisted. A blacklist value of '*' means all extensions are blacklisted unless they are explicitly listed in the whitelist. If this policy is left not set the user can install any extension in Google Chrome.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44727SV-57561CCI-000169Windows group policy: - 1. Open the group policy editor tool with gpedit.msc - 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\ - Policy Name: Configure extension installation blacklist - Policy State: Enabled - Policy Value: * - -Universal method: - 1. In the omnibox (address bar) type chrome://policy - 2. If ExtensionInstallBlacklist is not displayed under the Policy Name column or it is not set to * under the Policy Value column, then this is a finding. - -Windows method: - 1. Start regedit - 2. Navigate to HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlacklist - 3. If the a registry value name of 1 does not exist under that key or its value is not set to *, then this is a finding. -SRG-APP-000210<GroupDescription></GroupDescription>DTBC-0006Extensions that are approved for use must be whitelisted. -<VulnDiscussion>The whitelist should only contain organizationally approved extensions. This is to prevent a user from accidently whitelisitng a malicious extension. This policy allows you to specify which extensions are not subject to the blacklist. A blacklist value of ‘*’ means all extensions are blacklisted and users can only install extensions listed in the whitelist. By default, no extensions are whitelisted. If all extensions have been blacklisted by policy, then the whitelist policy can be used to allow specific extensions to be installed. Administrators should determine which extensions should be allowed to be installed by their users. If no extensions are whitelisted, then no extensions can be installed when combined with blacklisting all extensions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44729SV-57563CCI-001170Windows group policy: +Note: If AO Approved exceptions to this rule have been enabled, this is not a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0005Extensions installation must be blocklisted by default.<VulnDiscussion>Extensions are developed by third party sources and are designed to extend Google Chrome's functionality. An extension can be made by anyone, to do and access almost anything on a system; this means they pose a high risk to any system that would allow all extensions to be installed by default. Allows you to specify which extensions the users can NOT install. Extensions already installed will be removed if blocklisted. A blocklist value of '*' means all extensions are blocklisted unless they are explicitly listed in the allowlist. If this policy is left not set the user can install any extension in Google Chrome.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57561V-44727CCI-000169Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\ - Policy Name: Configure extension installation whitelist + Policy Name: Configure extension installation blocklist Policy State: Enabled - Policy Value: oiigbmnaadbkfbmpbfijlflahbdbdgdf (or 1) - -Note: oiigbmnaadbkfbmpbfijlflahbdbdgdf is the extension ID for scriptno(a commonly used Chrome extension)Universal method: + Policy Value: *Universal method: 1. In the omnibox (address bar) type chrome://policy - 2. If ExtensionInstallWhitelist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding. + 2. If ExtensionInstallBlocklist is not displayed under the Policy Name column or it is not set to * under the Policy Value column, then this is a finding. Windows method: 1. Start regedit - 2. Navigate to the key HKLM\Software\Policies\Google\Chrome\ExtensionInstallWhitelist - 3. If the ExtensionInstallWhitelist key is not set to 1 or oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator-approved extension IDs, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0007The default search providers name must be set.<VulnDiscussion>Specifies the name of the default search provider that is to be used, if left empty or not set, the host name specified by the search URL will be used. This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled. When doing internet searches it is important to use an encrypted connection via https.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44733SV-57567CCI-000381Windows group policy: + 2. Navigate to HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist + 3. If the a registry value name of 1 does not exist under that key or its value is not set to *, then this is a finding. SRG-APP-000210<GroupDescription></GroupDescription>DTBC-0006Extensions that are approved for use must be allowlisted.<VulnDiscussion>The allowlist should only contain organizationally approved extensions. This is to prevent a user from accidently allowlisitng a malicious extension. This policy allows you to specify which extensions are not subject to the blacklist. A blacklist value of ‘*’ means all extensions are blacklisted and users can only install extensions listed in the allowlist. By default, no extensions are allowlisted. If all extensions have been blacklisted by policy, then the allowlist policy can be used to allow specific extensions to be installed. Administrators should determine which extensions should be allowed to be installed by their users. If no extensions are allowlisted, then no extensions can be installed when combined with blacklisting all extensions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57563V-44729CCI-001170Windows group policy: +1. Open the group policy editor tool with gpedit.msc +2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\ +Policy Name: Configure extension installation allowlist +Policy State: Enabled +Policy Value: oiigbmnaadbkfbmpbfijlflahbdbdgdf + +Note: oiigbmnaadbkfbmpbfijlflahbdbdgdfis the extension ID for scriptno (a commonly used Chrome extension), other extension IDs may vary.Universal method: +1. In the omnibox (address bar) type chrome://policy +2. If ExtensionInstallAllowlist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding. + +Windows method: +1. Start regedit +2. Navigate to the key HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist +3. If the ExtensionInstallAllowlist key is not set to 1 and oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator-approved extension IDs, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0007The default search providers name must be set.<VulnDiscussion>Specifies the name of the default search provider that is to be used, if left empty or not set, the host name specified by the search URL will be used. This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled. When doing internet searches it is important to use an encrypted connection via https.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57567V-44733CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\ Policy Name: Default search provider name @@ -94,7 +90,7 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultSearchProviderName value name does not exist or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted), then this is a finding. -SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0008The default search provider URL must be set to perform encrypted searches.<VulnDiscussion>Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for. This option must be set when the 'DefaultSearchProviderEnabled' policy is enabled and will only be respected if this is the case. When doing internet searches it is important to use an encrypted connection via https.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44735SV-57569CCI-000381If the system is on the SIPRNet, this requirement is NA. +SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0008The default search provider URL must be set to perform encrypted searches.<VulnDiscussion>Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for. This option must be set when the 'DefaultSearchProviderEnabled' policy is enabled and will only be respected if this is the case. When doing internet searches it is important to use an encrypted connection via https.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57569V-44735CCI-000381If the system is on the SIPRNet, this requirement is NA. Windows group policy: 1. Open the group policy editor tool with gpedit.msc @@ -102,16 +98,16 @@ Windows group policy: Policy Name: Default search provider search URL Policy State: Enabled Policy Value: Must be set to an organization-approved encrypted search string - (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} )If the system is on the SIPRNet, this requirement is NA. + (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} )If the system is on the SIPRNet, this requirement is NA. Universal method: 1. In the omnibox (address bar) type chrome://policy - 2. If DefaultSearchProviderSearchURL is not displayed under the Policy Name column or it is not set to an organization-approved encrypted search string (ex. https://www.google.com/#q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) under the Policy Value column, this is a finding. + 2. If DefaultSearchProviderSearchURL is not displayed under the Policy Name column or it is not set to an organization-approved encrypted search string (ex. https://www.google.com/?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) under the Policy Value column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the DefaultSearchProviderSearchURL value name does not exist or its value data is not set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0009Default search provider must be enabled.<VulnDiscussion>Policy enables the use of a default search provider. If you enable this setting, a default search is performed when the user types text in the omnibox that is not a URL. You can specify the default search provider to be used by setting the rest of the default search policies. If these are left empty, the user can choose the default provider. If you disable this setting, no search is performed when the user enters non-URL text in the omnibox. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, the default search provider is enabled, and the user will be able to set the search provider list.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57571V-44737CCI-000381Windows group policy: + 3. If the DefaultSearchProviderSearchURL value name does not exist or its value data is not set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0009Default search provider must be enabled.<VulnDiscussion>Policy enables the use of a default search provider. If you enable this setting, a default search is performed when the user types text in the omnibox that is not a URL. You can specify the default search provider to be used by setting the rest of the default search policies. If these are left empty, the user can choose the default provider. If you disable this setting, no search is performed when the user enters non-URL text in the omnibox. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, the default search provider is enabled, and the user will be able to set the search provider list.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57571V-44737CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\ Policy Name: Enable the default search provider @@ -127,7 +123,7 @@ Windows method: 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultSearchProviderEnabled value name does not exist or its value data is not set to 1, then this is a finding. -Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0011The Password Manager must be disabled.<VulnDiscussion>Enables saving passwords and using saved passwords in Google Chrome. Malicious sites may take advantage of this feature by using hidden fields gain access to the stored information. If you enable this setting, users can have Google Chrome memorize passwords and provide them automatically the next time they log in to a site. If you disable this setting, users are not able to save passwords or use already saved passwords. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it. ListPassword manager should not be used as it stores passwords locally.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57575V-44741CCI-000381Windows group policy: +Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0011The Password Manager must be disabled.<VulnDiscussion>Enables saving passwords and using saved passwords in Google Chrome. Malicious sites may take advantage of this feature by using hidden fields gain access to the stored information. If you enable this setting, users can have Google Chrome memorize passwords and provide them automatically the next time they log in to a site. If you disable this setting, users are not able to save passwords or use already saved passwords. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it. ListPassword manager should not be used as it stores passwords locally.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57575V-44741CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Password Manager\ Policy Name: Enable Saving Passwords to the Password Manager @@ -140,21 +136,7 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the PasswordManagerEnabled value name does not exist or its value data is not set to 0, then this is a finding. -SRG-APP-000276<GroupDescription></GroupDescription>DTBC-0013The running of outdated plugins must be disabled.<VulnDiscussion>Running outdated plugins could lead to system compromise through the use of known exploits. Having plugins that updated to the most current version ensures the smallest attack surfuce possible. If you enable this setting, outdated plugins are used as normal plugins. If you disable this setting, outdated plugins will not be used and users will not be asked for permission to run them. If this setting is not set, users will be asked for permission to run outdated plugins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57579V-44745CCI-001240Windows group policy: - 1. Open the group policy editor tool with gpedit.msc - 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ - Policy Name: Allow running plugins that are outdated - Policy State: Disabled - Policy Value: N/A -Universal method: - 1. In the omnibox (address bar) type chrome://policy - 2. If AllowOutdatedPlugins is not displayed under the Policy Name column or it is not set to false under the Policy Name column, then this is a finding. - -Windows method: - 1. Start regedit - 2. Navigate to HKLM\Software\Policies\Google\Chrome - 3. If the AllowOutdatedPlugins value name does not exist or its value data is not set to 0, then this is a finding. -SRG-APP-000112<GroupDescription></GroupDescription>DTBC-0017Background processing must be disabled.<VulnDiscussion>Determines whether a Google Chrome process is started on OS login that keeps running when the last browser window is closed, allowing background apps to remain active. The background process displays an icon in the system tray and can always be closed from there. If this policy is set to True, background mode is enabled and cannot be controlled by the user in the browser settings. If this policy is set to False, background mode is disabled and cannot be controlled by the user in the browser settings. If this policy is left unset, background mode is initially disabled and can be controlled by the user in the browser settings.' - Google Chrome Administrators Policy ListThis setting, if enabled, allows Google Chrome to run at all times. There is two reasons that this is not wanted. First, it can tie up system resources that might otherwise be needed. Second, it does not make it obvious to the user that it is running and poorly written extensions could cause instability on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57587V-44753CCI-001695Windows group policy: +SRG-APP-000112<GroupDescription></GroupDescription>DTBC-0017Background processing must be disabled.<VulnDiscussion>Determines whether a Google Chrome process is started on OS login that keeps running when the last browser window is closed, allowing background apps to remain active. The background process displays an icon in the system tray and can always be closed from there. If this policy is set to True, background mode is enabled and cannot be controlled by the user in the browser settings. If this policy is set to False, background mode is disabled and cannot be controlled by the user in the browser settings. If this policy is left unset, background mode is initially disabled and can be controlled by the user in the browser settings.' - Google Chrome Administrators Policy ListThis setting, if enabled, allows Google Chrome to run at all times. There is two reasons that this is not wanted. First, it can tie up system resources that might otherwise be needed. Second, it does not make it obvious to the user that it is running and poorly written extensions could cause instability on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57587V-44753CCI-001695Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Continue running background apps when Google Chrome is closed @@ -167,7 +149,7 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the BackgroundModeEnabled value name does not exist or its value data is not set to 0, then this is a finding. -SRG-APP-000047<GroupDescription></GroupDescription>DTBC-0020Google Data Synchronization must be disabled.<VulnDiscussion>Disables data synchronization in Google Chrome using Google-hosted synchronization services and prevents users from changing this setting. If you enable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the user will be able to enable Google Sync. Google Sync is used to sync information between different user devices, this data is then stored on Google owned servers. The synced data may consist of information such as email, calendars, viewing history, etc. This feature must be disabled because the organization does not have control over the servers the data is stored on.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57593V-44759CCI-001374Windows group policy: +SRG-APP-000047<GroupDescription></GroupDescription>DTBC-0020Google Data Synchronization must be disabled.<VulnDiscussion>Disables data synchronization in Google Chrome using Google-hosted synchronization services and prevents users from changing this setting. If you enable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the user will be able to enable Google Sync. Google Sync is used to sync information between different user devices, this data is then stored on Google owned servers. The synced data may consist of information such as email, calendars, viewing history, etc. This feature must be disabled because the organization does not have control over the servers the data is stored on.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57593V-44759CCI-001374Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Disable synchronization of data with Google @@ -180,7 +162,7 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SyncDisabled value name does not exist or its value data is not set to 1, then this is a finding. -SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0021The URL protocol schema javascript must be disabled.<VulnDiscussion>Each access to a URL is handled by the browser according to the URL's "scheme". The "scheme" of a URL is the section before the ":". The term "protocol" is often mistakenly used for a "scheme". The difference is that the scheme is how the browser handles a URL and the protocol is how the browser communicates with a service. If a scheme or its associated protocol used by a browser is insecure or obsolete, vulnerabilities can be exploited resulting in exposed data or unrestricted access to the browser's system. The browser must be configured to disable the use of insecure and obsolete schemas (protocols). +SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0021The URL protocol schema javascript must be disabled.<VulnDiscussion>Each access to a URL is handled by the browser according to the URL's "scheme". The "scheme" of a URL is the section before the ":". The term "protocol" is often mistakenly used for a "scheme". The difference is that the scheme is how the browser handles a URL and the protocol is how the browser communicates with a service. If a scheme or its associated protocol used by a browser is insecure or obsolete, vulnerabilities can be exploited resulting in exposed data or unrestricted access to the browser's system. The browser must be configured to disable the use of insecure and obsolete schemas (protocols). This policy disables the listed protocol schemes in Google Chrome, URLs using a scheme from this list will not load and cannot be navigated to. If this policy is left not set or the list is empty all schemes will be accessible in Google Chrome.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57595V-44761CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ @@ -195,7 +177,7 @@ Windows method: 2. Navigate to HKLM\Software\Policies\Google\Chrome\URLBlacklist 3. If the URLBlacklist key does not exist, or the does not contain entries 1 set to javascript://*, then this is a finding. -SRG-APP-000047<GroupDescription></GroupDescription>DTBC-0023Cloud print sharing must be disabled.<VulnDiscussion>Policy enables Google Chrome to act as a proxy between Google Cloud Print and legacy printers connected to the machine. If this setting is enabled or not configured, users can enable the cloud print proxy by authentication with their Google account. If this setting is disabled, users cannot enable the proxy, and the machine will not be allowed to share it’s printers with Google Cloud Print. If this policy is not set, this will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57599V-44765CCI-001374Windows group policy: +SRG-APP-000047<GroupDescription></GroupDescription>DTBC-0023Cloud print sharing must be disabled.<VulnDiscussion>Policy enables Google Chrome to act as a proxy between Google Cloud Print and legacy printers connected to the machine. If this setting is enabled or not configured, users can enable the cloud print proxy by authentication with their Google account. If this setting is disabled, users cannot enable the proxy, and the machine will not be allowed to share it’s printers with Google Cloud Print. If this policy is not set, this will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57599V-44765CCI-001374Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable Google Cloud Print proxy @@ -207,7 +189,7 @@ Windows method: Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the CloudPrintProxyEnabled value name does not exist or its value data is not set to 0, then this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>DTBC-0025Network prediction must be disabled.<VulnDiscussion>Enables network prediction in Google Chrome and prevents users from changing this setting. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be disabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57603V-44769CCI-000366Windows group policy: + 3. If the CloudPrintProxyEnabled value name does not exist or its value data is not set to 0, then this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>DTBC-0025Network prediction must be disabled.<VulnDiscussion>Enables network prediction in Google Chrome and prevents users from changing this setting. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be disabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57603V-44769CCI-000366Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable network prediction @@ -218,7 +200,7 @@ Policy Value: Do not predict network actions on any network connection Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ -3. If the "NetworkPredictionOptions" value name does not exist or its value data is not set to "2," this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0026Metrics reporting to Google must be disabled.<VulnDiscussion>Enables anonymous reporting of usage and crash-related data about Google Chrome to Google and prevents users from changing this setting. If you enable this setting, anonymous reporting of usage and crash-related data is sent to Google. A crash report could contain sensitive information from the computer's memory. If you disable this setting, anonymous reporting of usage and crash-related data is never sent to Google. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the setting will be what the user chose upon installation / first run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57605V-44771CCI-000381Windows group policy: +3. If the "NetworkPredictionOptions" value name does not exist or its value data is not set to "2," this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0026Metrics reporting to Google must be disabled.<VulnDiscussion>Enables anonymous reporting of usage and crash-related data about Google Chrome to Google and prevents users from changing this setting. If you enable this setting, anonymous reporting of usage and crash-related data is sent to Google. A crash report could contain sensitive information from the computer's memory. If you disable this setting, anonymous reporting of usage and crash-related data is never sent to Google. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the setting will be what the user chose upon installation / first run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57605V-44771CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable reporting of usage and crash-related data @@ -232,7 +214,7 @@ Windows method: 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the MetricsReportingEnabled value name does not exist or its value data is not set to 0, then this is a finding. -Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0027Search suggestions must be disabled.<VulnDiscussion>Search suggestion should be disabled as it could lead to searches being conducted that were never intended to be made. Enables search suggestions in Google Chrome's omnibox and prevents users from changing this setting. If you enable this setting, search suggestions are used. If you disable this setting, search suggestions are never used. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44773SV-57607CCI-000381Windows group policy: +Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0027Search suggestions must be disabled.<VulnDiscussion>Search suggestion should be disabled as it could lead to searches being conducted that were never intended to be made. Enables search suggestions in Google Chrome's omnibox and prevents users from changing this setting. If you enable this setting, search suggestions are used. If you disable this setting, search suggestions are never used. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57607V-44773CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable search suggestions @@ -245,7 +227,7 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SearchSuggestEnabled value name does not exist or its value data is not set to 0, then this is a finding. -SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0029Importing of saved passwords must be disabled.<VulnDiscussion>Importing of saved passwords should be disabled as it could lead to unencrypted account passwords stored on the system from another browser to be viewed. This policy forces the saved passwords to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog. If disabled, the saved passwords are not imported. If it is not set, the user may be asked whether to import, or importing may happen automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44775SV-57609CCI-000381Windows group policy: +SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0029Importing of saved passwords must be disabled.<VulnDiscussion>Importing of saved passwords should be disabled as it could lead to unencrypted account passwords stored on the system from another browser to be viewed. This policy forces the saved passwords to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog. If disabled, the saved passwords are not imported. If it is not set, the user may be asked whether to import, or importing may happen automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57609V-44775CCI-000381Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Import saved passwords from default browser on first run @@ -257,10 +239,10 @@ Windows method: Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the ImportSavedPasswords value name does not exist or its value data is not set to 0, then this is a finding.SRG-APP-000080<GroupDescription></GroupDescription>DTBC-0030Incognito mode must be disabled.<VulnDiscussion>Incognito mode allows the user to browse the Internet without recording their browsing history/activity. From a forensics perspective, this is unacceptable. Best practice requires that browser history is retained. The "IncognitoModeAvailability" setting controls whether the user may utilize Incognito mode in Google Chrome. If 'Enabled' is selected or the policy is left unset, pages may be opened in Incognito mode. If 'Disabled' is selected, pages may not be opened in Incognito mode. If 'Forced' is selected, pages may be opened ONLY in Incognito mode. + 3. If the ImportSavedPasswords value name does not exist or its value data is not set to 0, then this is a finding.SRG-APP-000080<GroupDescription></GroupDescription>DTBC-0030Incognito mode must be disabled.<VulnDiscussion>Incognito mode allows the user to browse the Internet without recording their browsing history/activity. From a forensics perspective, this is unacceptable. Best practice requires that browser history is retained. The "IncognitoModeAvailability" setting controls whether the user may utilize Incognito mode in Google Chrome. If 'Enabled' is selected or the policy is left unset, pages may be opened in Incognito mode. If 'Disabled' is selected, pages may not be opened in Incognito mode. If 'Forced' is selected, pages may be opened ONLY in Incognito mode. 0 = Incognito mode available. 1 = Incognito mode disabled. - 2 = Incognito mode forced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44777SV-57611CCI-000166Windows group policy: + 2 = Incognito mode forced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57611V-44777CCI-000166Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Incognito mode availability @@ -273,7 +255,7 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the IncognitoModeAvailability value name does not exist or its value data is not set to 1, then this is a finding. -SRG-APP-000605<GroupDescription></GroupDescription>DTBC-0037Online revocation checks must be done.<VulnDiscussion>By setting this policy to true, the previous behavior is restored and online OCSP/CRL checks will be performed. If the policy is not set, or is set to false, then Chrome will not perform online revocation checks. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44789SV-57623CCI-000185Windows group policy: +SRG-APP-000605<GroupDescription></GroupDescription>DTBC-0037Online revocation checks must be done.<VulnDiscussion>By setting this policy to true, the previous behavior is restored and online OCSP/CRL checks will be performed. If the policy is not set, or is set to false, then Chrome will not perform online revocation checks. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57623V-44789CCI-000185Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Whether online OCSP/CRL checks are performed @@ -287,20 +269,25 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the EnableOnlineRevocationChecks value name does not exist or its value data is not set to 1, then this is a finding. -SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0038Safe Browsing must be enabled,<VulnDiscussion>Enables Google Chrome's Safe Browsing feature and prevents users from changing this setting. If you enable this setting, Safe Browsing is always active. If you disable this setting, Safe Browsing is never active. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it. Safe browsing uses a signature database to test sites when they are be loaded to ensure they don't contain any known malware.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44791SV-57625CCI-001166Windows group policy: +SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0038Safe Browsing must be enabled,<VulnDiscussion>Allows you to control whether Google Chrome's Safe Browsing feature is enabled and the mode it operates in. + +If this policy is set to 'NoProtection' (value 0), Safe Browsing is never active. + +If this policy is set to 'StandardProtection' (value 1, which is the default), Safe Browsing is always active in the standard mode. + +If this policy is set to 'EnhancedProtection' (value 2), Safe Browsing is always active in the enhanced mode, which provides better security, but requires sharing more browsing information with Google.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57625V-44791CCI-001166Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Safe Browsing Settings - Policy Name: Enable Safe Browsing + Policy Name: Safe Browsing Protection Level Policy State: Enabled - Policy Value: N/AUniversal method: - 1. In the omnibox (address bar) type chrome://policy - 2. If SafeBrowsingEnabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding. + Policy Value: StandardProtection or EnhancedProtectionUniversal method: + 1. In the omnibox (address bar) type chrome://policy + 2. If SafeBrowsingProtectionLevel is not displayed under the Policy Name column or it is not set to 1 or 2 under the Policy Value column, then this is a finding. Windows method: - 1. Start regedit - 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the SafeBrowsingEnabled value name does not exist or its value data is not set to 1, then this is a finding. -SRG-APP-000231<GroupDescription></GroupDescription>DTBC-0039Browser history must be saved.<VulnDiscussion>This policy disables saving browser history in Google Chrome and prevents users from changing this setting. If this setting is enabled, browsing history is not saved. If this setting is disabled or not set, browsing history is saved.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44793SV-57627CCI-001199Windows group policy: + 1. Start regedit + 2. Navigate to HKLM\Software\Policies\Google\Chrome\ + 3. If the SafeBrowsingProtectionLevel value name does not exist or its value data is not set to 1 or 2, then this is a finding.SRG-APP-000231<GroupDescription></GroupDescription>DTBC-0039Browser history must be saved.<VulnDiscussion>This policy disables saving browser history in Google Chrome and prevents users from changing this setting. If this setting is enabled, browsing history is not saved. If this setting is disabled or not set, browsing history is saved.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57627V-44793CCI-001199Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Disable saving browser history @@ -313,10 +300,10 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SavingBrowserHistoryDisabled value name does not exist or its value data is not set to 0, then this is a finding. -SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0040Default behavior must block webpages from automatically running plugins.<VulnDiscussion>This policy allows you to set whether websites are allowed to automatically run the Flash plugin. Automatically running the Flash plugin can be either allowed for all websites or denied for all websites. If this policy is left not set, the user will be able to change this setting manually. +SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0040Default behavior must block webpages from automatically running plugins.<VulnDiscussion>This policy allows you to set whether websites are allowed to automatically run the Flash plugin. Automatically running the Flash plugin can be either allowed for all websites or denied for all websites. If this policy is left not set, the user will be able to change this setting manually. 1 = Allow all sites to automatically run Flash plugin 2 = Block the Flash plugin - 3 = Click to play</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44795SV-57629CCI-000169Windows group policy: + 3 = Click to play</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57629V-44795CCI-000169Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Default Flash setting @@ -328,36 +315,10 @@ Windows method: Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\DefaultPluginsSetting - 3. If this key "DefaultPluginsSetting" does not exist or is not set to "3", this is a finding.SRG-APP-000080<GroupDescription></GroupDescription>DTBC-0045Session only based cookies must be disabled.<VulnDiscussion>Policy allows you to set a list of URL patterns that specify sites which are allowed to set session only cookies. If this policy is left not set the global default value will be used for all sites either from the 'DefaultCookiesSetting' policy if it is set, or the user's personal configuration otherwise. If the 'RestoreOnStartup' policy is set to restore URLs from previous sessions this policy will not be respected and cookies will be stored permanently for those sites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44799SV-57633CCI-000166Windows group policy: - 1. Open the group policy editor tool with gpedit.msc - 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings - Policy Name: Allow session only cookies on these sites - Policy State: Disabled - Policy Value: N/AUniversal method: -1. In the omnibox (address bar) type chrome://policy -2. If the policy ”CookiesSessionOnlyForUrls” exists, and has any defined values, this is a finding. -Windows method: - 1. Start regedit - 2. Navigate to HKLM\Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls - 3. If this key exists and has any defined values, this is a finding.SRG-APP-000456<GroupDescription></GroupDescription>DTBC-0050The version of Google Chrome running on the system must be a supported version.<VulnDiscussion>Google Chrome is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the browser can introduce security vulnerabilities to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-44805SV-57639CCI-002605Install a supported version of Google Chrome.Universal method: + 3. If this key "DefaultPluginsSetting" does not exist or is not set to "3", this is a finding.SRG-APP-000456<GroupDescription></GroupDescription>DTBC-0050The version of Google Chrome running on the system must be a supported version.<VulnDiscussion>Google Chrome is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the browser can introduce security vulnerabilities to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-57639V-44805CCI-002605Install a supported version of Google Chrome.Universal method: 1. In the omnibox (address bar) type chrome://settings/help 2. Cross-reference the build information displayed with the Google Chrome site to identify, at minimum, the oldest supported build available. As of July 2019, this is 74.x.x. -3. If the installed version of Chrome is not supported by Google, this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0051URLs must be whitelisted for plugin use<VulnDiscussion>This policy allows you to set a list of URL patterns that specify sites which are allowed to run the Flash plugin. If this policy is left not set, the global default value will be used for all sites either from the "DefaultPluginsSetting" policy if it is set, or the user’s personal configuration otherwise. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-52795SV-67011CCI-000381Windows group policy: - 1. Open the group policy editor tool with gpedit.msc - 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings - Policy Name: Allow the Flash plugin on these sites - Policy State: Enabled - Policy Value 1: [*.]mil - Policy Value 2: [*.]govUniversal method: - 1. In the omnibox (address bar) type chrome://policy - 2. If PluginsAllowedForUrls is not displayed under the Policy Name column or it is not set to a list of administrator approved URLs under the Policy Value column, then this is a finding. - -Windows method: - 1. Start regedit - 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the PluginsAllowedForUrls key does not exist and it does not contain a list of administrator approved URLs then this is a finding. - -Suggested: the set or subset of [*.]mil and [*.]govSRG-APP-000089<GroupDescription></GroupDescription>DTBC-0052Deletion of browser history must be disabled.<VulnDiscussion>Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-75165SV-89845CCI-000169Windows group policy: +3. If the installed version of Chrome is not supported by Google, this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0052Deletion of browser history must be disabled.<VulnDiscussion>Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-89845V-75165CCI-000169Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable deleting browser and download history @@ -369,7 +330,7 @@ Suggested: the set or subset of [*.]mil and [*.]govSRG-APP-000089<GroupDescription></GroupDescription>DTBC-0053Prompt for download location must be enabled.<VulnDiscussion>If the policy is enabled, the user will be asked where to save each file before downloading. If the policy is disabled, downloads will start immediately, and the user will not be asked where to save the file. If the policy is not configured, the user will be able to change this setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-94633V-79929CCI-000169Windows group policy: + 3. If the "AllowDeletingBrowserHistory" value name does not exist or its value data is not set to "0", this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0053Prompt for download location must be enabled.<VulnDiscussion>If the policy is enabled, the user will be asked where to save each file before downloading. If the policy is disabled, downloads will start immediately, and the user will not be asked where to save the file. If the policy is not configured, the user will be able to change this setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-94633V-79929CCI-000169Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Ask where to save each file before downloading @@ -380,7 +341,7 @@ Windows method: Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ -3. If the "PromptForDownloadLocation" value name does not exist or its value data is not set to "1", this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0055Download restrictions must be configured.<VulnDiscussion>Configure the type of downloads that Google Chrome will completely block, without letting users override the security decision. If you set this policy, Google Chrome will prevent certain types of downloads, and will not let user bypass the security warnings. When the "Block dangerous downloads" option is chosen, all downloads are allowed, except for those that carry SafeBrowsing warnings. When the "Block potentially dangerous downloads" option is chosen, all downloads allowed, except for those that carry SafeBrowsing warnings of potentially dangerous downloads. When the "Block all downloads" option is chosen, all downloads are blocked. When this policy is not set, (or the "No special restrictions" option is chosen), the downloads will go through the usual security restrictions based on SafeBrowsing analysis results. +3. If the "PromptForDownloadLocation" value name does not exist or its value data is not set to "1", this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0055Download restrictions must be configured.<VulnDiscussion>Configure the type of downloads that Google Chrome will completely block, without letting users override the security decision. If you set this policy, Google Chrome will prevent certain types of downloads, and will not let user bypass the security warnings. When the "Block dangerous downloads" option is chosen, all downloads are allowed, except for those that carry SafeBrowsing warnings. When the "Block potentially dangerous downloads" option is chosen, all downloads allowed, except for those that carry SafeBrowsing warnings of potentially dangerous downloads. When the "Block all downloads" option is chosen, all downloads are blocked. When this policy is not set, (or the "No special restrictions" option is chosen), the downloads will go through the usual security restrictions based on SafeBrowsing analysis results. Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option. These restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options. See https://developers.google.com/safe-browsing for more info on SafeBrowsing. 0 = No special restrictions @@ -400,22 +361,7 @@ Universal method: Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ -3. If the "DownloadRestrictions" value name does not exist or its value data is not set to "1" or "2", then this is a finding.SRG-APP-000416<GroupDescription></GroupDescription>DTBC-0056Chrome must be configured to allow only TLS.<VulnDiscussion>If this policy is not configured then Google Chrome uses a default minimum version, which is TLS 1.0. Otherwise, it may be set to one of the following values: "tls1", "tls1.1" or "tls1.2". -When set, Google Chrome will not use SSL/TLS versions less than the specified version. An unrecognized value will be ignored. -"tls1" = TLS 1.0 -"tls1.1" = TLS 1.1 -"tls1.2" = TLS 1.2</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96297V-81583CCI-002450Windows group policy: - 1. Open the “group policy editor” tool with gpedit.msc. - 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ - Policy Name: Minimum SSL version enabled - Policy State: Enabled - Policy Value: TLS 1.1Universal method: - 1. In the omnibox (address bar) type chrome://policy - 2. If "SSLVersionMin" is not displayed under the "Policy Name" column or it is not set to "tls1.1", this is a finding. -Windows method: - 1. Start regedit - 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the "SSLVersionMin" value name does not exist or its value data is not set to "tls1.1", this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0057Safe Browsing Extended Reporting must be disabled.<VulnDiscussion>Enables Google Chrome's Safe Browsing Extended Reporting and prevents users from changing this setting. Extended Reporting sends some system information and page content to Google servers to help detect dangerous apps and sites. +3. If the "DownloadRestrictions" value name does not exist or its value data is not set to "1" or "2", then this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0057Safe Browsing Extended Reporting must be disabled.<VulnDiscussion>Enables Google Chrome's Safe Browsing Extended Reporting and prevents users from changing this setting. Extended Reporting sends some system information and page content to Google servers to help detect dangerous apps and sites. If the setting is set to "True", then reports will be created and sent whenever necessary (such as when a security interstitial is shown). If the setting is set to "False", reports will never be sent. If this policy is set to "True" or "False", the user will not be able to modify the setting. @@ -430,7 +376,7 @@ Policy Value: N/ASRG-APP-000141<GroupDescription></GroupDescription>DTBC-0058WebUSB must be disabled.<VulnDiscussion>Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices. + 3. If the "SafeBrowsingExtendedReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0058WebUSB must be disabled.<VulnDiscussion>Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices. If this policy is left not set, ”3” will be used, and the user will be able to change it. 2 = Do not allow any site to request access to USB devices via the WebUSB API 3 = Allow sites to ask the user to grant access to a connected USB device</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96301V-81587CCI-000381Windows group policy: @@ -445,7 +391,7 @@ If this policy is left not set, ”3” will be used, and the user will be able Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ - 3. If the "DefaultWebUsbGuardSetting" value name does not exist or its value data is not set to "2", this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0060Chrome Cleanup must be disabled.<VulnDiscussion>If set to “False”, prevents Chrome Cleanup from scanning the system for unwanted software and performing cleanups. Manually triggering Chrome Cleanup from chrome://settings/cleanup is disabled. + 3. If the "DefaultWebUsbGuardSetting" value name does not exist or its value data is not set to "2", this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0060Chrome Cleanup must be disabled.<VulnDiscussion>If set to “False”, prevents Chrome Cleanup from scanning the system for unwanted software and performing cleanups. Manually triggering Chrome Cleanup from chrome://settings/cleanup is disabled. If set to “True” or unset, Chrome Cleanup periodically scans the system for unwanted software and should any be found, will ask the user if they wish to remove it. Manually triggering Chrome Cleanup from chrome://settings is enabled. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96305V-81591CCI-000169Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc @@ -458,7 +404,7 @@ Policy Value: N/ASRG-APP-000089<GroupDescription></GroupDescription>DTBC-0061Chrome Cleanup reporting must be disabled.<VulnDiscussion>If unset, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will then ask the user if they wish to clean up the unwanted software. The user can choose to share results of the cleanup with Google to assist with future unwanted software detection. These results contain file metadata and registry keys as described by the Chrome Privacy Whitepaper. + 3. If the "ChromeCleanupEnabled" value name does not exist or its value data is not set to "0", this is a finding.SRG-APP-000089<GroupDescription></GroupDescription>DTBC-0061Chrome Cleanup reporting must be disabled.<VulnDiscussion>If unset, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will then ask the user if they wish to clean up the unwanted software. The user can choose to share results of the cleanup with Google to assist with future unwanted software detection. These results contain file metadata and registry keys as described by the Chrome Privacy Whitepaper. If set to “false”, should Chrome Cleanup detect unwanted software, it will not report metadata about the scan to Google, overriding any policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will ask the user if they wish to clean up the unwanted software. Results of the cleanup will not be reported to Google and the user will not have the option to do so. If set to “true”, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will ask the user if they wish to clean up the unwanted software. Results of the cleanup will be reported to Google and the user will not have the option to prevent it. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96307V-81593CCI-000169Windows group policy: @@ -472,7 +418,7 @@ Policy Value: N/ASRG-APP-000141<GroupDescription></GroupDescription>DTBC-0063Google Cast must be disabled.<VulnDiscussion>If this policy is set to ”True” or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the “Cast toolbar” icon. + 3. If the "ChromeCleanupReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0063Google Cast must be disabled.<VulnDiscussion>If this policy is set to ”True” or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the “Cast toolbar” icon. If this policy set to ”False”, Google Cast will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96311V-81597CCI-000381Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Google Cast @@ -484,7 +430,7 @@ Policy Value: N/ASRG-APP-000141<GroupDescription></GroupDescription>DTBC-0064Autoplay must be disabled.<VulnDiscussion>Allows you to control if videos can play automatically (without user consent) with audio content in Google Chrome. + 3. If the "EnableMediaRouter" value name does not exist or its value data is not set to "0", this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0064Autoplay must be disabled.<VulnDiscussion>Allows you to control if videos can play automatically (without user consent) with audio content in Google Chrome. If the policy is set to “True”, Google Chrome is allowed to autoplay media. If the policy is set to “False”, Google Chrome is not allowed to autoplay media. The “AutoplayWhitelist” policy can be used to override this for certain URL patterns. By default, Google Chrome is not allowed to autoplay media. The “AutoplayWhitelist” policy can be used to override this for certain URL patterns.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96295V-81581CCI-000381Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ @@ -496,7 +442,7 @@ Policy Value: N/ASRG-APP-000210<GroupDescription></GroupDescription>DTBC-0065URLs must be whitelisted for Autoplay use.<VulnDiscussion>Controls the whitelist of URL patterns that autoplay will always be enabled on. + 3. If the "AutoplayAllowed" value name does not exist or its value data is not set to "0", this is a finding.SRG-APP-000210<GroupDescription></GroupDescription>DTBC-0065URLs must be whitelisted for Autoplay use.<VulnDiscussion>Controls the whitelist of URL patterns that autoplay will always be enabled on. If the “AutoplayAllowed” policy is set to “True” then this policy will have no effect. If the “AutoplayAllowed” policy is set to “False” then any URL patterns set in this policy will still be allowed to play.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-96303V-81589CCI-001170Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc @@ -511,11 +457,11 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the “AutoplayWhitelist” key does not exist and it does not contain a list of administrator-approved URLs, this is a finding. -Suggested: the set or subset of [*.]mil and [*.]govSRG-APP-000206<GroupDescription></GroupDescription>DTBC-0066Anonymized data collection must be disabled.<VulnDiscussion>Enable URL-keyed anonymized data collection in Google Chrome and prevent users from changing this setting. +Suggested: the set or subset of [*.]mil and [*.]govSRG-APP-000206<GroupDescription></GroupDescription>DTBC-0066Anonymized data collection must be disabled.<VulnDiscussion>Enable URL-keyed anonymized data collection in Google Chrome and prevent users from changing this setting. URL-keyed anonymized data collection sends URLs of pages the user visits to Google to make searches and browsing better. If you enable this policy, URL-keyed anonymized data collection is always active. If you disable this policy, URL-keyed anonymized data collection is never active. -If this policy is left not set, URL-keyed anonymized data collection will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-91203SV-101303CCI-001166Windows group policy: +If this policy is left not set, URL-keyed anonymized data collection will be enabled but the user will be able to change it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-101303V-91203CCI-001166Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable URL-keyed anonymized data collection @@ -526,10 +472,10 @@ Policy Value: NASRG-APP-000206<GroupDescription></GroupDescription>DTBC-0067Collection of WebRTC event logs must be disabled.<VulnDiscussion>If the policy is set to “true”, Google Chrome is allowed to collect WebRTC event logs from Google services (e.g., Google Meet), and upload those logs to Google. +3. If the “UrlKeyedAnonymizedDataCollectionEnabled" value name does not exist or its value data is not set to "0," this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0067Collection of WebRTC event logs must be disabled.<VulnDiscussion>If the policy is set to “true”, Google Chrome is allowed to collect WebRTC event logs from Google services (e.g., Google Meet), and upload those logs to Google. If the policy is set to “false”, or is unset, Google Chrome may not collect nor upload such logs. These logs contain diagnostic information helpful when debugging issues with audio or video calls in Chrome, such as the time and size of sent and received RTP packets, feedback about congestion on the network, and metadata about time and quality of audio and video frames. These logs do not contain audio or video contents from the call. -This data collection by Chrome can only be triggered by Google's web services, such as Google Hangouts or Google Meet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-91205SV-101305CCI-001166Windows group policy: +This data collection by Chrome can only be triggered by Google's web services, such as Google Hangouts or Google Meet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-101305V-91205CCI-001166Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Allow collection of WebRTC event logs from Google services @@ -540,7 +486,7 @@ Policy Value: NASRG-APP-000266<GroupDescription></GroupDescription>DTBC-0068Chrome development tools must be disabled.<VulnDiscussion>While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-97525SV-106629CCI-001312Windows group policy: +3. If the "WebRtcEventLogCollectionAllowed" value name does not exist or its value data is not set to "0," this is a finding.SRG-APP-000266<GroupDescription></GroupDescription>DTBC-0068Chrome development tools must be disabled.<VulnDiscussion>While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-106629V-97525CCI-001312Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome Policy Name: Control where Developer Tools can be used @@ -552,9 +498,9 @@ Policy Value: Disallow usage of the Developer ToolsSRG-APP-000206<GroupDescription></GroupDescription>DTBC-0069Guest Mode must be disabled.<VulnDiscussion>If this policy is set to true or not configured, Google Chrome will enable guest logins. Guest logins are Google Chrome profiles where all windows are in incognito mode. +3. If the key "DeveloperToolsAvailability" does not exist or is not set to "2", this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0069Guest Mode must be disabled.<VulnDiscussion>If this policy is set to true or not configured, Google Chrome will enable guest logins. Guest logins are Google Chrome profiles where all windows are in incognito mode. -If this policy is set to false, Google Chrome will not allow guest profiles to be started.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-102867SV-111829CCI-001166Windows group policy: +If this policy is set to false, Google Chrome will not allow guest profiles to be started.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-111829V-102867CCI-001166Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable guest mode in browser @@ -565,10 +511,10 @@ Policy State: DisabledSRG-APP-000206<GroupDescription></GroupDescription>DTBC-0070AutoFill for credit cards must be disabled.<VulnDiscussion>Enabling Google Chrome's AutoFill feature allows users to auto complete credit card information in web forms using previously stored information. +3. If the BrowserGuestModeEnabled value name does not exist or its value data is not set to 0, this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0070AutoFill for credit cards must be disabled.<VulnDiscussion>Enabling Google Chrome's AutoFill feature allows users to auto complete credit card information in web forms using previously stored information. If this setting is disabled, Autofill will never suggest or fill credit card information, nor will it save additional credit card information that the user might submit while browsing the web. -If this setting is enabled or has no value, the user will be able to control Autofill for credit cards in the UI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-102869SV-111831CCI-001166Windows group policy: +If this setting is enabled or has no value, the user will be able to control Autofill for credit cards in the UI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-111831V-102869CCI-001166Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable AutoFill for credit cards @@ -579,7 +525,7 @@ Policy State: DisabledSRG-APP-000206<GroupDescription></GroupDescription>DTBC-0071AutoFill for addresses must be disabled.<VulnDiscussion>Enabling Google Chrome's AutoFill feature allows users to auto complete address information in web forms using previously stored information. +3. If the AutofillCreditCardEnabled value name does not exist or its value data is not set to 0, this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0071AutoFill for addresses must be disabled.<VulnDiscussion>Enabling Google Chrome's AutoFill feature allows users to auto complete address information in web forms using previously stored information. If this setting is disabled, Autofill will never suggest or fill address information, nor will it save additional address information that the user might submit while browsing the web. If this setting is enabled or has no value, the user will be able to control Autofill for addresses in the UI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-111833V-102871CCI-001166Windows group policy: @@ -593,7 +539,7 @@ Policy State: DisabledSRG-APP-000206<GroupDescription></GroupDescription>DTBC-0072Import AutoFill form data must be disabled.<VulnDiscussion>This policy forces the autofill form data to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog. +3. If the AutofillAddressEnabled value name does not exist or its value data is not set to 0, this is a finding.SRG-APP-000206<GroupDescription></GroupDescription>DTBC-0072Import AutoFill form data must be disabled.<VulnDiscussion>This policy forces the autofill form data to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog. If disabled, the autofill form data is not imported. If it is not set, the user may be asked whether to import, or importing may happen automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-111835V-102873CCI-001166Windows group policy: @@ -608,4 +554,37 @@ Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the ImportAutofillFormData value name does not exist or its value data is not set to 0, this is a finding. - +SRG-APP-000416<GroupDescription></GroupDescription>DTBC-0056Chrome must be configured to allow only TLS.<VulnDiscussion>If this policy is not configured then Google Chrome uses a default minimum version, which is TLS 1.0. Otherwise, it may be set to one of the following values: "tls1", "tls1.1" or "tls1.2". +When set, Google Chrome will not use SSL/TLS versions less than the specified version. An unrecognized value will be ignored. +"tls1" = TLS 1.0 +"tls1.1" = TLS 1.1 +"tls1.2" = TLS 1.2</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081V-81583CCI-002450Windows group policy: + 1. Open the “group policy editor” tool with gpedit.msc. + 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ + Policy Name: Minimum SSL version enabled + Policy State: Enabled + Policy Value: TLS 1.2Universal method: + 1. In the omnibox (address bar) type chrome://policy + 2. If "SSLVersionMin" is not displayed under the "Policy Name" column or it is not set to "tls1.2", this is a finding. +Windows method: + 1. Start regedit + 2. Navigate to HKLM\Software\Policies\Google\Chrome\ + 3. If the "SSLVersionMin" value name does not exist or its value data is not set to "tls1.2", this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBC-0073Web Bluetooth API must be disabled.<VulnDiscussion>Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices. + +Leaving the policy unset lets sites ask for access, but users can change this setting. + +2 = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API +3 = Allow sites to ask the user to grant access to a nearby Bluetooth device</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Google Chrome Current WindowsDISADPMS TargetGoogle Chrome Current Windows4081SV-34246V-26961CCI-000381Windows group policy: +1. Open the “group policy editor” tool with gpedit.msc +2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings + Policy Name: Control use of the Web Bluetooth API + Policy State: Enabled + Policy Value: Do not allow any site to request access to Bluetooth devices via the Web Bluetooth APIUniversal method: +1. In the omnibox (address bar) type chrome://policy +2. If DefaultWebBluetoothGuardSetting is not displayed under the Policy Name column or it is not set to 2 under the Policy Value column, then this is a finding. + +Windows method: + 1. Start regedit + 2. Navigate to HKLM\Software\Policies\Google\Chrome\ + 3. If the DefaultWebBluetoothGuardSetting value name does not exist or its value data is not set to 2, then this is a finding. + \ No newline at end of file diff --git a/source/StigData/Archive/Linux.RHEL/U_RHEL_7_STIG_V3R3_Manual-xccdf.log b/source/StigData/Archive/Linux.RHEL/U_RHEL_7_STIG_V3R3_Manual-xccdf.log new file mode 100644 index 000000000..12c001f4c --- /dev/null +++ b/source/StigData/Archive/Linux.RHEL/U_RHEL_7_STIG_V3R3_Manual-xccdf.log @@ -0,0 +1,38 @@ +V-204399::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = '/org/gnome/desktop/screensaver/lock-delay'; FilePath = '/etc/dconf/db/local.d/locks/session'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = '/org/gnome/desktop/screensaver/lock-delay'; DoesNotContainPattern = '#\s*/org/gnome/desktop/screensaver/lock-delay'; FilePath = '/etc/dconf/db/local.d/locks/session'} +V-204400::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = '/org/gnome/desktop/session/idle-delay'; DoesNotContainPattern = '#\s*/org/gnome/desktop/session/idle-delay'; FilePath = '/etc/dconf/db/local.d/locks/session'} +V-204403::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = '/org/gnome/desktop/screensaver/idle-activation-enabled'; DoesNotContainPattern = '#\s*/org/gnome/desktop/screensaver/idle-activation-enabled'; FilePath = '/etc/dconf/db/local.d/locks/session'} +V-204424::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/pam.d/password-auth'; OrganizationValueTestString = 'rule V-204424 is reviewed for guidence on configurating ContainsLine/DoesNotContainPattern '}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/pam.d/system-auth'; OrganizationValueTestString = 'rule V-204424 is reviewed for guidence on configurating ContainsLine/DoesNotContainPattern '} +V-204449::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = '# Generated via PowerSTIG'; FilePath = '/etc/modprobe.d/usb-storage.conf'}HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = '# Generated via PowerSTIG'; FilePath = '/etc/modprobe.d/blacklist.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'install usb-storage /bin/true'; DoesNotContainPattern = '#\s*install\s*usb-storage\s*/bin/true'; FilePath = '/etc/modprobe.d/usb-storage.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'blacklist usb-storage'; DoesNotContainPattern = '#\s*blacklist\s*usb-storage'; FilePath = '/etc/modprobe.d/blacklist.conf'} +V-204450::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = '# Generated via PowerSTIG'; FilePath = '/etc/modprobe.d/dccp.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'install dccp /bin/true'; DoesNotContainPattern = '#\s*install\s*dccp\s*/bin/true'; FilePath = '/etc/modprobe.d/dccp.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'blacklist dccp'; DoesNotContainPattern = '#\s*blacklist\s*dccp'; FilePath = '/etc/modprobe.d/blacklist.conf'} +V-204454::SELINUXTYPE = targeted::SELINUXTYPE=targeted +V-204453::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'SELINUX=enforcing'; DoesNotContainPattern = '^#\s*SELINUX.*$|^SELINUX\s*=\s*(?!enforcing)\w*$'; FilePath = '/etc/selinux/config'} +V-204492::*::HardCodedRule(nxServiceRule)@{DscResource = 'nxService'; Enabled = $false; Name = 'kdump'} +V-204513::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/audit/auditd.conf'; OrganizationValueTestString = 'the value of the "space_left" keyword is not set to 25 percent of the total partition size'} +V-204549::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = '-w /etc/sudoers -p wa -k privileged-actions'; DoesNotContainPattern = '#\s*-w /etc/sudoers -p wa -k privileged-actions'; FilePath = '/etc/audit/rules.d/audit.rules'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = '-w /etc/sudoers.d/ -p wa -k privileged-actions'; DoesNotContainPattern = '#\s*-w /etc/sudoers.d/ -p wa -k privileged-actions'; FilePath = '/etc/audit/rules.d/audit.rules'} +V-204580::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'banner /etc/issue'; DoesNotContainPattern = '#\s*banner\s*/etc/issue'; FilePath = '/etc/ssh/sshd_config'} +V-204594::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'Protocol 2'; DoesNotContainPattern = '^#\s*Protocol.*$|^Protocol\s*(?!2\b)\w*$'; FilePath = '/etc/ssh/sshd_config'} +V-204405::# cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth::# grep /etc/pam.d/passwd +V-204497::*::HardCodedRule(nxPackageRule)@{DscResource = 'nxPackage'; Ensure = 'Present'; Name = 'dracut-fips'} +V-204498::*::HardCodedRule(nxPackageRule)@{DscResource = 'nxPackage'; Ensure = 'Present'; Name = 'aide'} +V-204504::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = '-f 2'; DoesNotContainPattern = '^#\s*-f\s+2|^\s*-f\s*1'; FilePath = '/etc/audit/rules.d/audit.rules'} +V-204506::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'active = yes'; DoesNotContainPattern = '\s*active\s*=\s*no|active=yes|#\s*active\s*=.*'; FilePath = '/etc/audisp/plugins.d/au-remote.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'direction = out'; DoesNotContainPattern = '#\s*direction\s*=\s*out'; FilePath = '/etc/audisp/plugins.d/au-remote.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'path = /sbin/audisp-remote'; DoesNotContainPattern = '#\s*path\s*=\s*/sbin/audisp-remote'; FilePath = '/etc/audisp/plugins.d/au-remote.conf'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'type = always'; DoesNotContainPattern = '#\s*type\s*=\s*always'; FilePath = '/etc/audisp/plugins.d/au-remote.conf'} +V-204509::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/audisp/audisp-remote.conf'; OrganizationValueTestString = 'the IP address of the log aggregation server is defined; i.e.: remote_server = '} +V-204511::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/audisp/audisp-remote.conf'; OrganizationValueTestString = 'the value of the "disk_full_action" option is set to "SYSLOG", "SINGLE", or "HALT"; i.e.: "disk_full_action = single" '} +V-204512::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/audisp/audisp-remote.conf'; OrganizationValueTestString = 'the "network_failure_action" option is set to "SYSLOG", "SINGLE", or "HALT"; i.e.: "network_failure_action = syslog" '} +V-204515::*::HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/audit/auditd.conf'; OrganizationValueTestString = 'the value of the "action_mail_acct" keyword is set to "root" and/or other accounts for security personnel; i.e.: "action_mail_acct = root" '} +V-204576::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = $null; FilePath = '/etc/security/limits.d/204576-powerstig.conf'; OrganizationValueTestString = 'the "maxlogins" value is set to "10" or less '} +V-204579::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = '# Generated via PowerSTIG'; FilePath = '/etc/profile.d/tmout.sh'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = $null; DoesNotContainPattern = $null; FilePath = '/etc/profile.d/tmout.sh'; OrganizationValueTestString = 'the following statement is true when leveraging the correct nxFileLine ContainsLine format: "If the file "/etc/profile.d/tmout.sh" does not exist with the contents shown above, the value of "TMOUT" is greater than 900, or the timeout values are commented out, this is a finding.'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'readonly TMOUT'; DoesNotContainPattern = '^\s*readonly\s+(?!TMOUT\b).*$|^\s*#\s*readonly.*$'; FilePath = '/etc/profile.d/tmout.sh'}HardCodedRule(nxFileLineRule)@{DscResource = 'nxFileLine'; ContainsLine = 'export TMOUT'; DoesNotContainPattern = '^\s*export\s+(?!TMOUT\b).*$|^\s*#\s*export.*$'; FilePath = '/etc/profile.d/tmout.sh'} +V-204584::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'kernel.randomize_va_space = 2'; FilePath = '/etc/sysctl.d/204584-powerstig.conf'} +V-204609::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.all.accept_source_route = 0'; FilePath = '/etc/sysctl.d/204609-powerstig.conf'} +V-204610::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.all.rp_filter = 1'; FilePath = '/etc/sysctl.d/204610-powerstig.conf'} +V-204611::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.default.rp_filter = 1'; FilePath = '/etc/sysctl.d/204611-powerstig.conf'} +V-204612::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.default.accept_source_route = 0'; FilePath = '/etc/sysctl.d/204612-powerstig.conf'} +V-204613::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.icmp_echo_ignore_broadcasts = 1'; FilePath = '/etc/sysctl.d/204613-powerstig.conf'} +V-204614::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.default.accept_redirects = 0'; FilePath = '/etc/sysctl.d/204614-powerstig.conf'} +V-204615::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.all.accept_redirects = 0'; FilePath = '/etc/sysctl.d/204615-powerstig.conf'} +V-204616::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.default.send_redirects = 0'; FilePath = '/etc/sysctl.d/204616-powerstig.conf'} +V-204617::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.conf.all.send_redirects = 0'; FilePath = '/etc/sysctl.d/204617-powerstig.conf'} +V-204625::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv4.ip_forward = 0'; FilePath = '/etc/sysctl.d/204625-powerstig.conf'} +V-204630::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'net.ipv6.conf.all.accept_source_route = 0'; FilePath = '/etc/sysctl.d/204630-powerstig.conf'} +V-237634::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'Defaults !targetpw'; FilePath = '/etc/sudoers.d/237634a-powerstig.conf'}HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'Defaults !rootpw'; FilePath = '/etc/sudoers.d/237634b-powerstig.conf'}HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = 'Defaults !runaspw'; FilePath = '/etc/sudoers.d/237634c-powerstig.conf'} +V-237635::*::HardCodedRule(nxFileRule)@{DscResource = 'nxFile'; Contents = $null; FilePath = '/etc/sudoers.d/237635-powerstig.conf'; OrganizationValueTestString = 'the "Defaults timestamp_timeout=[value]" must be a number that is greater than or equal to "0" '} diff --git a/source/StigData/Archive/Linux.RHEL/U_RHEL_7_STIG_V3R3_Manual-xccdf.xml b/source/StigData/Archive/Linux.RHEL/U_RHEL_7_STIG_V3R3_Manual-xccdf.xml new file mode 100644 index 000000000..62198a0b9 --- /dev/null +++ b/source/StigData/Archive/Linux.RHEL/U_RHEL_7_STIG_V3R3_Manual-xccdf.xml @@ -0,0 +1,5084 @@ +acceptedRed Hat Enterprise Linux 7 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 3 Benchmark Date: 23 Apr 20213.2.2.360791.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-APP-000179<GroupDescription></GroupDescription>O365-AC-000001Macros must be blocked from running in Access files from the Internet.<VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. + +If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content”, users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. + +If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108737V-99633CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Block macros from running in Office files from the Internet" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Block macros from running in Office files from the Internet" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\access\security + +If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-AC-000002Trust Bar Notifications for unsigned application add-ins in Access must be disabled and blocked.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108739V-99635CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\access\security + +If the value NoTBPromptUnsignedAddin is REG_DWORD = 1, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-AC-000003VBA Macros not digitally signed must be blocked in Access.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected. + +If you disable this policy setting, "Disable all with notification" will be the default setting. + +If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document. + +Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases. + +Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. + +Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108741V-99637CCI-000381Set User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center >> VBA Macro Notification Settings to "Disable all except digitally signed macros".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Disable all except digitally signed macros". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\Microsoft\office\16.0\access\security + +If the value vbawarnings is REG_DWORD = 2, this is not a finding. Values of REG_DWORD = 3 or 4 are also acceptable values. If the registry key does not exist or the value is REG_DWORD =1, this is a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-AC-000004Allowing Trusted Locations on the network must be disabled in Access.<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. + +If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by selecting the "Allow Trusted Locations on my network (not recommended)" check box in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. + +If you disable or do not configure this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. Disabling this policy setting does not delete any network locations from the Trusted Locations list. Instead, it forces the selected application to treat the locations as non-trusted and prevents users from adding new network locations to the list. + +If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. + +Disabling this policy setting will cause disruption for users who add network locations to the Trusted Locations list. However, it is not recommended to enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box itself states), so in practice it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108743V-99639CCI-001662Set the User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center >> Trusted Locations >> Allow trusted Locations on the network to "Disabled".Verify the policy for Set the User Configuration >> Administrative Templates >> Microsoft Access 2016 >> Application Settings >> Security >> Trust Center >> Trusted Locations >> Allow trusted Locations on the network is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\access\security\trusted locations + +If the value for allownetworklocations is REG_DWORD = 0, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-CO-000001The Macro Runtime Scan Scope must be enabled for all documents.<VulnDiscussion>This policy setting specifies for which documents the VBA Runtime Scan feature is enabled. + +If the feature is disabled for all documents, no runtime scanning of enabled macros will be performed. + +If the feature is enabled for low trust documents, the feature will be enabled for all documents for which macros are enabled except: + - Documents opened while macro security settings are set to "Enable All Macros" + - Documents opened from a Trusted Location + - Documents that are Trusted Documents + - Documents that contain VBA that is digitally signed by a Trusted Publisher + +If the feature is enabled for all documents, then the above class of documents are not excluded from the behavior. + +This protocol allows the VBA runtime to report to the Anti-Virus system certain high-risk code behaviors it is about to execute and allows the Anti-Virus to report back to the process if the sequence of observed behaviors indicates likely malicious activity so the Office application can take appropriate action. + +When this feature is enabled, affected VBA projects' runtime performance may be reduced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108745V-99641CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings "Macro Runtime Scan Scope" to "Enable for all documents".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016>> Security Settings "Macro Runtime Scan Scope" is set to "Enable for all documents". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\security + +If the value for macroruntimescanscope is REG_DWORD = 2, this is not a finding. +SRG-APP-000429<GroupDescription></GroupDescription>O365-CO-000002Document metadata for rights managed Office Open XML files must be protected.<VulnDiscussion>This policy setting determines whether metadata is encrypted in Office Open XML files that are protected by Information Rights Management (IRM). If you enable this policy setting, Excel, PowerPoint, and Word encrypt metadata stored in rights-managed Office Open XML files and override any configuration changes on users' computers. + +If you disable this policy setting, Office 2016 applications cannot encrypt metadata in rights-managed Office Open XML files, which can reduce security. If you do not configure this policy setting, when Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata associated with the document is not encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108747V-99643CCI-002476Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Protect document metadata for rights managed Office Open XML Files" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Protect document metadata for rights managed Office Open XML Files" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\common\security + +If the value DRMEncryptProperty is REG_DWORD = 1, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-CO-000003The Office client must be prevented from polling the SharePoint Server for published links.<VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications can poll Office servers to retrieve lists of published links. + +If this policy setting is enabled, Office 365 ProPlus applications cannot poll an Office server for published links. + +If this policy setting is disabled or not configured, users of Office 365 ProPlus applications can see and use links to Microsoft SharePoint Server sites from those applications. Published links can be configured to Office applications during initial deployment, and can add or change links as part of regular operations. These links appear on the My SharePoint Sites tab of the Open, Save, and Save As dialog boxes when opening and saving documents from these applications. Links can be targeted so they only appear to users who are members of particular audiences. + +Note: This policy setting applies to Microsoft SharePoint Server specifically. It does not apply to Microsoft SharePoint Foundation. +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108749V-99645CCI-000381CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Server Settings >> Disable the Office client from polling the SharePoint Server for published links to "Enabled". Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Server Settings >> Disable the Office client from polling the SharePoint Server for published links is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\portal + +If the value for linkpublishingdisabled is REG_DWORD = "1", this is not a finding. +SRG-APP-000516<GroupDescription></GroupDescription>O365-CO-000004Custom user interface (UI) code must be blocked from loading in all Office applications.<VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications load any custom user interface (UI) code included with a document or template. Office 365 ProPlus allows developers to extend the UI with customization code that is included in a document or template. + +If this policy setting is enabled, Office 365 ProPlus applications cannot load any UI customization code included with documents and templates. + +If this policy setting is not configured or disabled, Office 365 ProPlus applications load any UI customization code included with a document or template when opening it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108751V-99647CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Global Options >> Customize >> Disable UI extending from documents and templates to Enabled: Disallow in Word; Excel; PowerPoint; Access; Outlook; Publisher; Project; Visio; InfoPath.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Global Options >> Customize >> Disable UI extending from documents and templates is set to Enabled: Disallow in Word; Excel; PowerPoint; Access; Outlook; Publisher; Project; Visio; InfoPath + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\toolbars + +If the value noextensibilitycustomizationfromdocument is REG_DWORD = 1 for all installed Office programs, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-CO-000005ActiveX Controls must be initialized in Safe Mode.<VulnDiscussion>This policy setting specifies the Microsoft ActiveX initialization security level for all Microsoft Office applications. ActiveX controls can adversely affect a computer directly. In addition, malicious code can be used to compromise an ActiveX control and attack a computer. + +To indicate the safety of an ActiveX control, developers can denote them as Safe for Initialization (SFI). SFI indicates that a control is safe to open and run, and that it is not capable of causing a problem for any computer, regardless of whether it has persisted data values or not. If a control is not marked SFI, it is possible that the control could adversely affect a computer--or it could mean that the developers did not test the control in all situations and are not sure whether it might be compromised in the future. If you enable this policy setting, you can set the ActiveX security level to a number between 1 and 6. These security levels are as follows: + +1. Regardless of how the control is marked, load it and use the persisted values (if any). This setting does not prompt the user. + +2. If SFI, load the control in safe mode and use persisted values (if any). If not SFI, load in unsafe mode with persisted values (if any), or use the default (first-time initialization) settings. This level is similar to the default configuration, but does not prompt the user. + +3. If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings. + +4. If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings. + +5. If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values. + +6. If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values. + +If you disable or do not configure this policy setting, if a control is marked SFI, the application loads the control in safe mode and uses persisted values (if any). If the control is not marked SFI, the application loads the control in unsafe mode with persisted values (if any), or uses the default (first-time initialization) settings. In both situations, the Message Bar informs users that the controls have been disabled and prompts them to respond. + +Important: Some ActiveX controls do not respect the safe mode registry setting, and therefore might load persisted data even though you configure this setting to instruct the control to use safe mode. This setting only increases security for ActiveX controls that are accurately marked as SFI. In situations that involve malicious or poorly designed code, an ActiveX control might be inaccurately marked as SFI.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108753V-99649CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "ActiveX Control Initialization" to "Enabled + 6".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "ActiveX Control Initialization" is set to "Enabled (If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values.) + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\Common\Security + +If the value UFIControls exists, this is a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-CO-000006Macros in all Office applications that are opened programmatically by another application must be opened based upon macro security level.<VulnDiscussion>This policy setting controls whether macros can run in an Office 365 ProPlus application that is opened programmatically by another application. If this policy setting is enabled, the user can choose from three options for controlling macro behavior in Excel, PowerPoint, and Word when the application is opened programmatically: + +- Disable macros by default ¬- all macros are disabled in the programmatically opened application. +- Macros enabled (default) - macros can run in the programmatically opened application. This option enforces the default configuration in Excel, PowerPoint, and Word. +- User application macro security level - macro functionality is determined by the setting in the "Macro Settings" section of the Trust Center. + +If this policy setting is disabled or not configured, when a separate program is used to launch Microsoft Excel, PowerPoint, or Word programmatically, any macros can run in the programmatically opened application without being blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108755V-99651CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Automation Security" to "Enabled (Use application macro security level)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Automation Security" is set to "Enabled (Use application macro security level)". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\Common\Security + +If the value AutomationSecurity is REG_DWORD = 2, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-CO-000007Trust Bar notifications must be configured to display information in the Message Bar about the content that has been automatically blocked.<VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications notify users when potentially unsafe features or content are detected, or whether such features or content are silently disabled without notification. + +The Message Bar in Office 365 ProPlus applications is used to identify security issues, such as unsigned macros or potentially unsafe add-ins. When such issues are detected, the application disables the unsafe feature or content and displays the Message Bar at the top of the active window. The Message Bar informs the users about the nature of the security issue and, in some cases, provides the users with an option to enable the potentially unsafe feature or content, which could harm the user's computer. + +If you enable this policy setting, Office 365 ProPlus applications do not display information in the Message Bar about potentially unsafe content that has been detected or has automatically been blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108757V-99653CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Disable all Trust Bar notifications for security issues" to "Disabled".Verify the policy value for User Configuration >> Microsoft Office 2016 >> Security Settings >> Disable all Trust Bar notifications for security issues is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\trustcenter + +If the value for trustbar is set to REG_DWORD = 0, this is not a finding.SRG-APP-000231<GroupDescription></GroupDescription>O365-CO-000008Office applications must be configured to specify encryption type in password-protected Office 97-2003 files.<VulnDiscussion>This policy setting enables you to specify an encryption type for password-protected Office 97-2003 files. + +If you enable this policy setting, you can specify the type of encryption that Office applications will use to encrypt password-protected files in the older Office 97-2003 file formats. The chosen encryption type must have a corresponding cryptographic service provider (CSP) installed on the computer that encrypts the file. See the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\ registry key for a list of CSPs installed on the local computer. Specify the encryption type to use by entering it in the provided text box in the following form: + +<Encryption Provider>,<Encryption Algorithm>,<Encryption Key Length>. +For example, Microsoft Enhanced Cryptographic Provider v1.0,RC4,128 + +If you do not configure this policy setting, Excel, PowerPoint, and Word use Office 97/2000 Compatible encryption, a proprietary encryption method, to encrypt password-protected Office 97-2003 files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108759V-99655CCI-001199Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office 97-2003 files to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office 97-2003 files is set to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\security + +If the value defaultencryption12 is set to REG_SZ = "Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256", this is not a finding.SRG-APP-000231<GroupDescription></GroupDescription>O365-CO-000009Office applications must be configured to specify encryption type in password-protected Office Open XML files.<VulnDiscussion>This policy setting allows you to specify an encryption type for Office Open XML files. + +If you enable this policy setting, you can specify the type of encryption that Office applications use to encrypt password-protected files in the Office Open XML file formats used by Excel, PowerPoint, and Word. The chosen encryption type must have a corresponding cryptographic service provider (CSP) installed on the computer that encrypts the file. See the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\ registry key for a list of CSPs installed on the local computer. Specify the encryption type to use by entering it in the provided text box in the following form: + +<Encryption Provider>,<Encryption Algorithm>,<Encryption Key Length> + +For example: Microsoft Enhanced Cryptographic Provider v1.0,RC4,128 + +If you disable or do not configure this policy setting, the default CSP is used. The default cryptographic service provider (CSP) is Microsoft Enhanced RSA and AES Cryptographic Provider, AES-128, 128-bit. + +Note: This policy setting does not take effect unless the registry key +HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\<office application name>\Security\Crypto\CompatMode is set to 0. By default the CompatMode registry key is set to 1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108761V-99657CCI-001199Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office Open XML files to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Encryption type for password protected Office Open XML files is set to Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\security + +If the value OpenXMLEncryption is REG_SZ = "Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256", this is not a finding.SRG-APP-000340<GroupDescription></GroupDescription>O365-CO-000010Users must be prevented from creating new trusted locations in the Trust Center.<VulnDiscussion>This policy setting controls whether trusted locations can be defined by users, the Office Customization Tool (OCT), and Group Policy, or if they must be defined by Group Policy alone. + +If you enable this policy setting, users can specify any location as a trusted location, and a computer can have a combination of user-created, OCT-created, and Group Policy-created trusted locations. + +If you disable this policy setting, all trusted locations that are not created by Group Policy are disabled and users cannot create new trusted locations in the Trust Center. + +If you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled. + +Note: InfoPath and Outlook do not recognize trusted locations, and therefore are unaffected by this policy setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108763V-99659CCI-002235Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings >> Trust Center >> Allow mix of policy and user locations to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016\Security Settings\Trust Center >> Allow mix of policy and user locations is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\common\security\trusted locations + +If the value for allow user locations is set to REG_DWORD = 0, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-CO-000012Office applications must not load XML expansion packs with Smart Documents.<VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications can load an XML expansion pack manifest file with a Smart Document.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108767V-99663CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Smart Documents (Word, Excel) >> Disable Smart Document's use of manifests to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Smart Documents (Word, Excel) >> Disable Smart Document's use of manifests is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\common\smart tag + +If the value for neverloadmanifests is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-CO-000013The load of controls in Forms3 must be blocked.<VulnDiscussion>This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe for Initialization (SFI) or Unsafe for Initialization (UFI). + +ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as SFI, which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer, or the developers may not have tested the control in all situations and are not sure whether their control might be compromised at some future date. SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety was not important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked UFI, which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. + +If you enable this policy setting, you can choose from four options for loading controls in UserForms: + +1. For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. + +2. Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: + +- For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using the default properties. +- For an SFI signed control that supports both safe and unsafe modes, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 365 ProPlus release. + +3. Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: + +- For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control with its default properties. +- For an SFI signed control, load in safe mode. + +4. For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). + +If you disable or do not configure this policy setting, the behavior is as if you enable this policy setting and then select option 1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108769V-99665CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" to "Enabled:1". Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" is set to Enabled and 1 from drop down. (For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration.)". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\keycupoliciesmsvbasecurity + +If the value LoadControlsInForms is REG_DWORD=1, this is not a finding. +SRG-APP-000207<GroupDescription></GroupDescription>O365-CO-000014Add-on Management must be enabled for all Office 365 ProPlus programs.<VulnDiscussion>Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons may contain viruses or other malicious code. Disabling or not configuring this setting could allow malicious code or users to become active on user computers or the network. For example, a malicious user can monitor and then use keystrokes that user's type into Internet Explorer. Even legitimate add-ons may demand resources, compromising the performance of Internet Explorer and the operating systems for user computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108771V-99667CCI-001662Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Add-on Management" to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Add-on Management" is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT + +If the value for each installed Office Program is REG_DWORD = 1, this is not a finding.SRG-APP-000179<GroupDescription></GroupDescription>O365-CO-000015Consistent MIME handling must be enabled for all Office 365 ProPlus programs.<VulnDiscussion>Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied on to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. + +TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108773V-99669CCI-000803Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Consistent Mime Handling" to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Consistent Mime Handling is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling + +If the value for all installed Office programs is set to "True", this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-CO-000016User name and password must be disabled in all Office programs.<VulnDiscussion>The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate website but actually opens a deceptive (spoofed) website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108775V-99671CCI-001170Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Disable user name and password" to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Disable user name and password" is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-CO-000017The Information Bar must be enabled in all Office programs.<VulnDiscussion>This policy setting controls whether Office 365 ProPlus applications notify users when potentially unsafe features or content are detected, or whether such features or content are silently disabled without notification. The Message Bar in Office 2016 applications is used to identify security issues, such as unsigned macros or potentially unsafe add-ins. When such issues are detected, the application disables the unsafe feature or content and displays the Message Bar at the top of the active window. The Message Bar informs the users about the nature of the security issue and, in some cases, provides the users with an option to enable the potentially unsafe feature or content, which could harm the user's computer. + +If you enable this policy setting, Office 365 ProPlus applications do not display information in the Message Bar about potentially unsafe content that has been detected or has automatically been blocked. + +If you disable this policy setting, Office 365 ProPlus applications display information in the Message Bar about content that has automatically been blocked. + +If you do not configure this policy setting, if an Office 365 ProPlus application detects a security issue, the Message Bar is displayed. However, this configuration can be modified by users in the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108777V-99673CCI-001662Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Information Bar to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Information Bar is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_securityband + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-CO-000018The Local Machine Zone Lockdown Security must be enabled in all Office programs.<VulnDiscussion>Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine zone, making this security zone a prime target for malicious users and code. Disabling or not configuring this setting could allow pages in the Internet zone to navigate to pages in the Local Machine zone to then run code to elevate privileges. This could allow malicious code or users to become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108779V-99675CCI-000366Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Local Machine Zone Lockdown to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Local Machine Zone Lockdown Security is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown + +If the value for all installed Office programs is REG_DWORD = 1, this is not a finding.SRG-APP-000179<GroupDescription></GroupDescription>O365-CO-000019The MIME Sniffing safety feature must be enabled in all Office programs.<VulnDiscussion>Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. + +TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108781V-99677CCI-000803Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Mime Sniffing Safety Feature to "Enabled" for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Mime Sniffing Safety Feature is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing + +If the value for all installed Office Programs is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-CO-000020Navigate URL must be enabled in all Office programs.<VulnDiscussion>To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer attempts to load a malformed URL, a security risk could occur.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108783V-99679CCI-001170Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Navigate URL to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Navigate URL is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000179<GroupDescription></GroupDescription>O365-CO-000021Object Caching Protection must be enabled in all Office programs.<VulnDiscussion>Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. FIPS 140-2 approved TLS versions include TLS V1.0 or greater. + +TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108785V-99681CCI-000803Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Object Caching Protection to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Object Caching Protection is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000112<GroupDescription></GroupDescription>O365-CO-000022Protection from zone elevation must be enabled in all Office programs.<VulnDiscussion>Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine zone, making this security zone a prime target for malicious users and code. Disabling or not configuring this setting could allow pages in the Internet zone to navigate to pages in the Local Machine zone to then run code to elevate privileges. This could allow malicious code or users to become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108787V-99683CCI-001695Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Protection from Zone Elevation to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Protection from Zone Elevation is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_zone_elevation + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-CO-000023ActiveX installation restriction must be enabled in all Office programs.<VulnDiscussion>Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like the other types of HTML or Microsoft Silverlight-based controls. Disabling or not configuring this setting does not block prompts for ActiveX control installations, and these prompts display to users. This could allow malicious code to become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108789V-99685CCI-002460Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict ActiveX Install to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict ActiveX Install is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_activexinstall + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000112<GroupDescription></GroupDescription>O365-CO-000024File Download Restriction must be enabled in all Office programs.<VulnDiscussion>Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the download. User preferences may also allow the download to occur without prompting or interaction with the user. Even if Internet Explorer prompts the user to accept the download, some websites abuse this functionality. Malicious websites may continually prompt users to download a file or present confusing dialog boxes to trick users into downloading or running a file. If the download occurs and it contains malicious code, the code could become active on user computers or the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108791V-99687CCI-001695Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict File Download to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Restrict File Download is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-CO-000025The Save from URL feature must be enabled in all Office programs.<VulnDiscussion>Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the Web (MOTW) comment, indicating the page was saved from a site on the Internet, Internet Explorer runs the page in the Internet security zone instead of the less restrictive Local Intranet security zone. This functionality can be controlled separately for instances of Internet Explorer spawned by Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a web page). If Internet Explorer does not evaluate the page for a MOTW, potentially dangerous code could be allowed to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108793V-99689CCI-001170Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Saved from URL to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Saved from URL is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_unc_saved + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000112<GroupDescription></GroupDescription>O365-CO-000026Scripted Windows Security restrictions must be enabled in all Office programs.<VulnDiscussion>Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computers in some manner. Disabling or not configuring this setting allows unknown websites to: +- Create browser windows appearing to be from the local operating system. +- Draw active windows displaying outside of the viewable areas of the screen capturing keyboard input. +- Overlay parent windows with their own browser windows to hide important system information, choices, or prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108795V-99691CCI-001695Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >>Scripted Window Security Restrictions to "Enabled" and select the check boxes for all installed Office programs.Verify the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >> Scripted Window Security Restrictions is set to "Enabled" and the check box is selected for every installed Office program. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS + +If the value for all installed programs is REG_DWORD = 1, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-CO-000027Flash player activation must be disabled in all Office programs.<VulnDiscussion>This policy setting controls whether the Adobe Flash control can be activated by Office documents. Note that activation blocking applies only within Office processes. + +If you enable this policy setting, you can choose from three options to control whether and how Flash is blocked from activation: + +1. "Block all activation" prevents the Flash control from being loaded, whether directly referenced by the document or indirectly by another embedded object. +2. "Block embedding/linking, allow other activation" prevents the Flash control from being loaded when directly referenced by the document, but does not prevent activation through another object. +3. "Allow all activation" restores Office's default behavior, allowing the Flash control to be activated. + +Because this setting is not a true Group Policy setting and "tattoos" the registry, enabling the "Allow all activation" option is the only way to restore default behavior after either of the "Block" options has been applied. It is not recommended to configure this setting to "Disabled" or "Not Configured" after it has been enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108797V-99693CCI-002460Set the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> Block Flash activation in Office documents >> Enabled >> Block all activation to "Enabled" (Block all activation).Verify the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> Block Flash activation in Office documents >> Enabled >> Block all activation is set to "Enabled" Block all activation. + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\SOFTWARE\Microsoft\Office\Common\COM Compatibility + +If the value for COMMENT is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000001Trusted Locations on the network must be disabled in Excel.<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. + +If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by selecting the "Allow Trusted Locations on my network (not recommended)" check box in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. + +If you disable or do not configure this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. Disabling this policy setting does not delete any network locations from the Trusted Locations list. Instead, it forces the selected application to treat the locations as non-trusted and prevents users from adding new network locations to the list. + +If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. + +Disabling this policy setting will cause disruption for users who add network locations to the Trusted Locations list. However, it is not recommended to enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box itself states), so in practice it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108799V-99695CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\trusted locations + +If the value AllowNetworkLocations is REG_DWORD = 0, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-EX-000002VBA Macros not digitally signed must be blocked in Excel.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108801V-99697CCI-000381Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Application Settings >> Security >> Trust Center >> "VBA macro Notification Settings" to "Enabled" and "Disable all except digitally signed macros" from the Options.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Application Settings >> Security >> Trust Center >> "VBA macro Notification Settings" is set to "Enabled" and "Disable all except digitally signed macros" from the Options. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\Microsoft\office\16.0\excel\security + +If the value vbawarnings is REG_DWORD = 3, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000003Dynamic Data Exchange (DDE) server launch in Excel must be blocked.<VulnDiscussion>This policy setting allows you to control whether Dynamic Data Exchange (DDE) server launch is allowed. + +By default, DDE server launch is turned off, but users can turn on DDE server launch by going to File >> Options >> Trust Center >> Trust Center Settings >> External Content. + +For security reasons, turning on DDE server launch is not recommended. + +Note: For DDE server launch to work, Dynamic Data Exchange (DDE) server lookup must be turned on. Be sure that the “Don't allow Dynamic Data Exchange (DDE) server lookup” policy setting is not enabled, because enabling that policy setting turns off DDE server lookup. + +If you enable this policy setting, DDE server launch is not allowed, and users cannot turn on DDE server launch in the Trust Center. + +If you disable this policy setting, DDE server launch is allowed, and users cannot turn off DDE server launch in the Trust Center. For security reasons, this is not recommended. + +If you do not configure this policy setting, DDE server launch is turned off, but users can turn on DDE server launch in the Trust Center. + +Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108803V-99699CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server launch in Excel to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server launch in Excel is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\external content + +If the value for "disableddeserverlaunch" is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000004Dynamic Data Exchange (DDE) server lookup in Excel must be blocked.<VulnDiscussion>This policy setting allows you to control whether Dynamic Data Exchange (DDE) server lookup is allowed. + +By default, DDE server lookup is turned on, but users can turn off DDE server lookup by going to File >> Options >> Trust Center >> Trust Center Settings >> External Content. + +If you enable this policy setting, DDE server lookup is not allowed, and users cannot turn on DDE server lookup in the Trust Center. + +Note: If you are using Dynamic Data Exchange (DDE) server launch, which is not recommended, do not enable this policy setting, because DDE server launch requires DDE server lookup to be on. + +If you disable or do not configure this policy setting, DDE server lookup is turned on, but users can turn off DDE server lookup in the Trust Center. + +Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108805V-99701CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server lookup in Excel to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server lookup in Excel is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\external content + +If the value for "disableddeserverlookup" is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000005Open/save of dBase III / IV format files must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. + +If you enable this policy setting, you can specify whether users can open, view, edit, or save files. + +The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108807V-99703CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "dBase III / IV files" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "dBase III / IV files" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value DBaseFiles is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000006Open/save of Dif and Sylk format files must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108809V-99705CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Dif and Sylk files" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Dif and Sylk files" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value DifandSylkFiles is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000007Open/save of Excel 2 macrosheets and add-in files must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108811V-99707CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 macrosheets and add-in files" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 macrosheets and add-in files" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL2Macros is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000008Open/save of Excel 2 worksheets must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108813V-99709CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 worksheets" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 2 worksheets" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL2Worksheets is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000009Open/save of Excel 3 macrosheets and add-in files must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108815V-99711CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 macrosheets and add-in files" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 macrosheets and add-in files" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL3Macros is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000010Open/save of Excel 3 worksheets must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108817V-99713CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 worksheets" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 3 worksheets" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL3Worksheets is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000011Open/save of Excel 4 macrosheets and add-in files must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108819V-99715CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 macrosheets and add-in files" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 macrosheets and add-in files" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL4Macros is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000012Open/save of Excel 4 workbooks must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108821V-99717CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 workbooks" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 workbooks" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL4Workbooks is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000013Open/save of Excel 4 worksheets must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108823V-99719CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 worksheets" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 4 worksheets" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value XL4Worksheets is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000014Open/save of Excel 95 workbooks must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108825V-99721CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Excel 95 workbooks to "Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Excel 95 workbooks is set to "Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\fileblock + +If the value for xl9597workbooksandtemplates is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000015Open/save of Excel 95-97 workbooks and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108827V-99723CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 95-97 workbooks and templates" to "Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings "Excel 95-97 workbooks and templates" is set to "Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\office\16.0\excel\security\fileblock + +If the value XL9597WorkbooksandTemplates is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000016The default file block behavior must be set to not open blocked files in Excel.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108829V-99725CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Set default file block behavior to "Enabled:Blocked files are not opened".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Set default file block behavior is set to "Blocked files are not opened". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\fileblock + +If the value OpenInProtectedView is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000017Open/save of Web pages and Excel 2003 XML spreadsheets must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108831V-99727CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Web pages and Excel 2003 XML spreadsheets to "Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> File Block Settings >> Web pages and Excel 2003 XML spreadsheets is set to "Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\fileblock + +If the value for htmlandxmlssfiles is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000018Extraction options must be blocked when opening corrupt Excel workbooks.<VulnDiscussion>This policy setting controls whether Excel presents users with a list of data extraction options before beginning an Open and Repair operation when users choose to open a corrupt workbook in repair or extract mode. + +If you enable this policy setting, Excel opens the file using the Safe Load process and does not prompt users to choose between repairing or extracting data. + +If you disable or do not configure this policy setting, Excel prompts the user to select either to repair or to extract data, and to select either to convert to values or to recover formulas.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108833V-99729CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Data Recovery >> Do not show data extraction options when opening corrupt workbooks to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Data Recovery >> Do not show data extraction options when opening corrupt workbooks is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\options + +If the value for extractdatadisableui is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000019Updating of links in Excel must be prompted and not automatic.<VulnDiscussion>This policy setting controls whether Excel prompts users to update automatic links, or whether the updates occur in the background with no prompt. + +If you enable or do not configure this policy setting, Excel will prompt users to update automatic links. In addition, the "Ask to update automatic links" user interface option under File tab >> Advanced >> General is selected. + +If you disable this policy setting, Excel updates automatic links without prompting or informing users, which could compromise the integrity of some of the information in the workbook.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108835V-99731CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Ask to update automatic links to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Ask to update automatic links is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\options\binaryoptions + +If the value for fupdateext_78_1 is REG_DWORD = 1, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-EX-000020Loading of pictures from Web pages not created in Excel must be disabled.<VulnDiscussion>This policy setting controls whether Excel loads graphics when opening Web pages that were not created in Excel. It configures the "Load pictures from Web pages not created in Excel" option under the File tab >> Options >> Advanced >> General >> Web Options... >> General tab. + +If you enable or do not configure this policy setting, Excel loads any graphics that are included in the pages, regardless of whether they were originally created in Excel. + +If you disable this policy setting, Excel will not load any pictures from Web pages that were not created in Excel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108837V-99733CCI-002460Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Web Options... >> General >> Load pictures from Web pages not created in Excel to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Advanced >> Web Options... >> General. + +Load pictures from Web pages not created in Excel is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\internet + +If the value for donotloadpictures is REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-EX-000021AutoRepublish in Excel must be disabled.<VulnDiscussion>This policy setting allows administrators to disable the AutoRepublish feature in Excel. If users choose to publish Excel data to a static Web page and enable the AutoRepublish feature, Excel saves a copy of the data to the Web page every time the user saves the workbook. By default, a message dialog displays every time the user saves a published workbook when AutoRepublish is enabled. From this dialog, the user can disable AutoRepublish temporarily or permanently, or select "Do not show this message again" to prevent the dialog from appearing after every save. If the user selects "Do not show this message again", Excel will continue to automatically republish the data after every save without informing the user. + +If you enable this policy setting, the AutoRepublish feature is turned off and Excel users will need to publish data to the Web manually. + +If you disable or do not configure this policy setting, users can enable the AutoRepublish feature to automatically republish workbooks saved as type Web Page.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108839V-99735CCI-000366Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Disable AutoRepublish to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Disable AutoRepublish is to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\options + +If the value for disableautorepublish is REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-EX-000022AutoRepublish warning alert in Excel must be enabled.<VulnDiscussion>This policy setting allows administrators to disable the AutoRepublish feature in Excel. If users choose to publish Excel data to a static Web page and enable the AutoRepublish feature, Excel saves a copy of the data to the Web page every time the user saves the workbook. By default, a message dialog displays every time the user saves a published workbook when AutoRepublish is enabled. From this dialog, the user can disable AutoRepublish temporarily or permanently, or select "Do not show this message again" to prevent the dialog from appearing after every save. If the user selects "Do not show this message again", Excel will continue to automatically republish the data after every save without informing the user. + +If you enable this policy setting, the AutoRepublish feature is turned off and Excel users will need to publish data to the Web manually. + +If you disable or do not configure this policy setting, users can enable the AutoRepublish feature to automatically republish workbooks saved as type Web Page.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108841V-99737CCI-000366Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Do not show AutoRepublish warning alert to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Save >> Do not show AutoRepublish warning alert is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\options + +If value for disableautorepublishwarning is REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-EX-000023File extensions must be enabled to match file types in Excel.<VulnDiscussion>This policy setting controls how Excel loads file types that do not match their extension. Excel can load files with extensions that do not match the files' type. For example, if a comma-separated values (CSV) file named example.csv is renamed example.xls (or any other file extension supported by Excel 2003 and earlier only), Excel can properly load it as a CSV file. + +If you enable this policy setting, you can choose from three options for working with files that have non-matching extensions: +- Allow different - Excel opens the files properly without warning users that the files have non-matching extensions. If users subsequently edit and save the files, Excel preserves both the true, underlying file format and the incorrect file extension. +- Allow different, but warn - Excel opens the files properly, but warns users about the file type mismatch. This option is the default configuration in Excel. +- Always match file type - Excel does not open any files that have non-matching extensions. + +If you disable or do not configure this policy setting, if users attempt to open files with the wrong extension, Excel opens the file and displays a warning that the file type is not what Excel expected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108843V-99739CCI-000366Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Force file extension to match file type to "Always match file type".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Force file extension to match file type is set to "Always match file type". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security + +If value for extensionhardening is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000024Scan of encrypted macros in Excel Open XML workbooks must be enabled.<VulnDiscussion>This policy setting controls whether encrypted macros in Open XML workbooks be are required to be scanned with anti-virus software before being opened. + +If you enable this policy setting, you may choose one of these options: +- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros. +- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load. +- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file. + +If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108845V-99741CCI-001170Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Scan encrypted macros in Excel Open XML workbooks to "Scan encrypted macros (default)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Scan encrypted macros in Excel Open XML workbooks is set to "Scan encrypted macros (default)". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security + +If the value excelbypassencryptiedmacrosscan does not exist, this is not a finding. + +If the value for excelbypassencryptedmacroscan is REG_DWORD = 0, this is not a finding.SRG-APP-000112<GroupDescription></GroupDescription>O365-EX-000025File validation in Excel must be enabled.<VulnDiscussion>This policy setting allows you turn off the file validation feature. + +If you enable this policy setting, file validation will be turned off. + +If you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108847V-99743CCI-001695Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Turn off file validation to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Turn off file validation is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\filevalidation + +If the value for enableonload is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000026WEBSERVICE Function Notification in Excel must be configured to disable all, with notifications.<VulnDiscussion>This policy setting controls how Excel will warn users when WEBSERVICE functions are present. + +If you enable this policy setting, you can choose from three options for determining how the specified applications will warn the user about WEBSERVICE functions: +- Disable all with notification: The application displays the Trust Bar for all WEBSERVICE functions. This option enforces the default configuration in Office. +- Disable all without notification: The application disables all WEBSERVICE functions and does not notify users. +- Enable all WEBSERVICE functions (not recommended): The application enables all WEBSERVICE functions and does not notify users. This option can significantly reduce security by allowing information disclosure to third-party web services. + +If you disable this policy setting, the “Disable all with notification” will be the default setting. + +If you do not configure this policy setting, when users open workbooks that contain WEBSERVICE functions, Excel will open the files with the WEBSERVICE functions disabled and display the Trust Bar with a warning that WEBSERVICE functions are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content," then the document is added as a trusted document.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108849V-99745CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> WEBSERVICE Function Notification Settings to "Enabled" and "Disable all with notification".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> WEBSERVICE Function Notification Settings is set to "Enabled" and "Disable all with notification". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security + +If the value webservicefunctionwarnings does not exist, this is not a finding. + +If the value for webservicefunctionwarnings is REG_DWORD = 1, this is not a finding. + +If the value for webservicefunctionwarnings is REG_DWORD = 2, this is a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000027Macros must be blocked from running in Excel files from the Internet.<VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. + +If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content”, users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. + +If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108851V-99747CCI-001170Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security + +If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-EX-000028Trust Bar notification must be enabled for unsigned application add-ins in Excel and blocked.<VulnDiscussion>This policy setting controls whether the specified Office 2016 applications notify users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the ''Require that application add-ins are signed by Trusted Publisher'' policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if an application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the ''Add-ins'' category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108853V-99749CCI-001749Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security + +If the value for notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000029Untrusted Microsoft Query files must be blocked from opening in Excel.<VulnDiscussion>This policy setting controls whether Microsoft Query files (.iqy, oqy, .dqy, and .rqy) in an untrusted location are prevented from opening. + +If you enable this policy setting, Microsoft Query files in an untrusted location are prevented from opening. Users will not be able to change this setting under File >> Options >> Trust Center >> Trust Center Settings >> External Content. + +If you disable or do not configure this policy setting, Microsoft Query files in an untrusted location are not prevented from opening, unless users have changed this setting in the Trust Center. + +Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108855V-99751CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Always prevent untrusted Microsoft Query files from opening to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Always prevent untrusted Microsoft Query files from opening is set to "Enabled". +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\excel\security\external content. +Value for enableblockunsecurequeryfiles should be REG_DWORD = 1 + +If the value for enableblockunsecurequeryfiles is Reg_DWORD = 1, this is not a finding. +SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000030Untrusted database files must be opened in Excel in Protected View mode.<VulnDiscussion>This policy setting controls whether database files (.dbf) opened from an untrusted location are always opened in Protected View. + +If you enable this policy setting, database files opened from an untrusted location are always opened in Protected View. Users will not be able to change this setting under File >> Options >> Trust Center >> Trust Center Settings >> Protected View. + +If you disable or do not configure this policy setting, database files opened from an untrusted location are not opened in Protected View, unless users have changed this setting in the Trust Center. + +Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108857V-99753CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Always open untrusted database files in Protected View to "Enabled". Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Always open untrusted database files in Protected View is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\polices\microsoft\office\16.0\excel\security\protectedview + +If the value for enabledatabasefileprotectedview is REG_DWORD = 1, this is not a finding. +SRG-APP-000207<GroupDescription></GroupDescription>O365-EX-000031Files from Internet zone must be opened in Excel in Protected View mode.<VulnDiscussion>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View. + +If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View. + +If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108859V-99755CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview + +If the value DisableInternetFilesInPV is REG_DWORD = 0, this is not a finding. + +If the value does not exist, this is not a finding. + +If the value is REG_DWORD = 1, this is a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000032Files from unsafe locations must be opened in Excel in Protected View mode.<VulnDiscussion>This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations. + +If you enable this policy setting, files located in unsafe locations do not open in Protected View. + +If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108861V-99757CCI-001170Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview + +If the value DisableUnsafeLocationsInPV is REG_DWORD = 0, this is not a finding. + +If the value does not exist, this is not a finding. + +If the value is REG_DWORD = 1, this is a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000033Files failing file validation must be opened in Excel in Protected view mode and disallow edits.<VulnDiscussion>This policy setting controls how Office handles documents when they fail file validation. + +If you enable this policy setting, you can configure the following options for files that fail file validation: +- Block files completely. Users cannot open the files. +- Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting. +- Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting. + +If you disable this policy setting, Office follows the "Open files in Protected View and disallow edit" behavior. + +If you do not configure this policy setting, Office follows the "Open files in Protected View and allow edit" behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108863V-99759CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails to "Enabled: Open in Protected View". + +Uncheck the "Allow edit" check box.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails is set to "Enabled: Open in Protected View". Verify the check box for "Allow edit" is not selected. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\Excel\security\filevalidation + +If the value openinprotectedview does not exist, this is not a finding. + +If both the value for openinprotectedview is REG_DWORD = 1 and the value for DisableEditFromPV is set to REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-EX-000034File attachments from Outlook must be opened in Excel in Protected mode.<VulnDiscussion>This policy setting allows you to determine if Excel files in Outlook attachments open in Protected View. + +If you enable this policy setting, Outlook attachments do not open in Protected View. + +If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108865V-99761CCI-001170Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Turn off Protected View for attachments opened from Outlook to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> Protected View >> Turn off Protected View for attachments opened from Outlook is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\excel\security\protectedview + +If the value DisableAttachmentsInPV is REG_DWORD = 0, this is not a finding.SRG-APP-000219<GroupDescription></GroupDescription>O365-LY-000001The SIP security mode in Lync must be enabled.<VulnDiscussion>When Lync connects to the server, it supports various authentication mechanisms. This policy allows the user to specify whether Digest and Basic authentication are supported. Disabled (default): NTLM/Kerberos/TLS-DSK/Digest/Basic Enabled: Authentication mechanisms: NTLM/Kerberos/TLS-DSK Gal Download: Requires HTTPS if user is not logged in as an internal user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108867V-99763CCI-001184Set the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Configure SIP security mode" to "Enabled".Verify the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Configure SIP security mode" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\Software\Policies\Microsoft\office\16.0\lync + +If the value enablesiphighsecuritymode is REG_DWORD = 1, this is not a finding.SRG-APP-000219<GroupDescription></GroupDescription>O365-LY-000002The HTTP fallback for SIP connection in Lync must be disabled.<VulnDiscussion>Prevents from HTTP being used for SIP connection in case TLS or TCP fail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108869V-99765CCI-001184Set the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Disable HTTP fallback for SIP connection" to "Enabled".Verify the policy value for Computer Configuration >> Administrative Templates >> Skype for Business 2016 >> Microsoft Lync Feature Policies "Disable HTTP fallback for SIP connection" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKLM\Software\Policies\Microsoft\office\16.0\lync + +If the value disablehttpconnect is REG_DWORD = 1, this is not a finding.SRG-APP-000575<GroupDescription></GroupDescription>O365-OU-000001The Exchange client authentication with Exchange servers must be enabled to use Kerberos Password Authentication.<VulnDiscussion>This policy setting controls which authentication method Outlook uses to authenticate with Microsoft Exchange Server. Note: Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments. + +If you enable this policy setting, you can choose from three different options for controlling how Outlook authenticates with Microsoft Exchange Server: + +- Kerberos/NTLM password authentication. Outlook attempts to authenticate using the Kerberos authentication protocol. If this attempt fails, Outlook attempts to authenticate using NTLM. This option is the default configuration. +- Kerberos password authentication. Outlook attempts to authenticate using the Kerberos protocol only. +- NTLM password authentication. Outlook attempts to authenticate using NTLM only. + +If you disable or do not configure this policy setting, Outlook will attempt to authenticate using the Kerberos authentication protocol. If it cannot (because no Windows 2000 or later domain controllers are available), it will authenticate using NTLM.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108871V-99767CCI-001967Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Authentication with Exchange Server to Kerberos Password Authentication.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Authentication with Exchange Server is set to Kerberos Password Authentication. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security!authenticationservice + +If the value authenticationservice is set to REG_DWORD = 16 (decimal) or 10 (hex), this is not a finding.SRG-APP-000575<GroupDescription></GroupDescription>O365-OU-000002Outlook must use remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers.<VulnDiscussion>This policy setting controls whether Outlook uses remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers. + +If you enable this policy setting, Outlook uses RPC encryption when communicating with an Exchange server. Note: RPC encryption only encrypts the data from the Outlook client computer to the Exchange server. It does not encrypt the messages themselves as they traverse the Internet. + +If you disable or do not configure this policy setting, RPC encryption is still used by default. This setting allows you to override the corresponding per-profile setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108873V-99769CCI-001967Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Enable RPC encryption to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Account Settings >> Exchange >> Enable RPC encryption is set to "Enabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\rpc + +If the value for enablerpcencryption is set to REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-OU-000003Scripts associated with public folders must be prevented from execution in Outlook.<VulnDiscussion>This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108875V-99771CCI-001170Set the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for public folders to "Enabled".Verify the policy for Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for public folders is set to "Enabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for publicfolderscript is set to REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-OU-000004Scripts associated with shared folders must be prevented from execution in Outlook.<VulnDiscussion>This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared folders.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108877V-99773CCI-001170Set the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for shared folders to "Enabled".Verify the policy for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Do not allow Outlook object model scripts to run for shared folders is set to "Enabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for sharedfolderscript is set to REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-OU-000005Files dragged from an Outlook e-mail to the file system must be created in ANSI format.<VulnDiscussion>This policy setting controls whether e-mail messages dragged from Outlook to the file system are saved in Unicode or ANSI format.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108879V-99775CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Use Unicode format when dragging e-mail message to file system to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Other >> Advanced >> Use Unicode format when dragging e-mail message to file system is set to "Disabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\options\general + +If the value for msgformat is set to REG_DWORD = 0, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-OU-000006Junk e-mail level must be enabled at a setting of High.<VulnDiscussion>This policy setting controls your Junk E-mail protection level. The Junk E-mail Filter in Outlook helps to prevent junk e-mail messages, also known as spam, from cluttering user's Inbox. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to discover whether or not it is probably spam. + +If you enable this policy setting, you can select one of the four listed options available. After you select an option, users will not be able to change it. + +If you disable this policy setting, Outlook reverts to the user-defined protection level. + +If you do not configure this policy setting, users can change their junk e-mail filtering options.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108881V-99777CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Preferences >> Junk E-mail >> Junk E-mail protection level to "High".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Preferences >> Junk E-mail >> Junk E-mail protection level is set to "High". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\options\mail + +If the value junkmailprotection is set to "High", this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-OU-000007Active X One-Off forms must only be enabled to load with Outlook Controls.<VulnDiscussion>By default, third-party ActiveX controls are not allowed to run in one-off forms in Outlook. You can change this behavior so that Safe Controls (Microsoft Forms 2.0 controls and the Outlook Recipient and Body controls) are allowed in one-off forms, or so that all ActiveX controls are allowed to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108883V-99779CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Allow Active X One Off Forms to "Enabled" "Load only Outlook Controls".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Allow Active X One Off Forms is set to "Enabled" "Load only Outlook Controls". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for allowactivexoneoffforms is REG_DWORD = 0, this is not a finding.SRG-APP-000340<GroupDescription></GroupDescription>O365-OU-000008Outlook must be configured to prevent users overriding attachment security settings.<VulnDiscussion>This policy setting prevents users from overriding the set of attachments blocked by Outlook. + +If you enable this policy setting users will be prevented from overriding the set of attachments blocked by Outlook. Outlook also checks the "Level1Remove" registry key when this setting is specified. + +If you disable or do not configure this policy setting, users will be allowed to override the set of attachments blocked by Outlook.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108885V-99781CCI-002235Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Prevent users from customizing attachment security settings to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Prevent users from customizing attachment security settings is set to "Enabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook + +If the value for disallowattachmentcustomization is set to REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-OU-000009Internet must not be included in Safe Zone for picture download in Outlook.<VulnDiscussion>This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the Internet are downloaded without Outlook users explicitly choosing to do so. + +If you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the Internet and users will not be able to change the setting. + +If you disable or do not configure this policy setting, Outlook does not consider the Internet a safe zone, which means that Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108887V-99783CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Automatic Picture Download Settings >> Include Internet in Safe Zones for Automatic Picture Download to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Automatic Picture Download Settings >> Include Internet in Safe Zones for Automatic Picture Download is set to "Disabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\ microsoft\office\ 16.0\outlook\options\mail + +If the value for Internet is set to REG_DWORD = 0, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-OU-000010The Publish to Global Address List (GAL) button must be disabled in Outlook.<VulnDiscussion>This policy setting controls whether Outlook users can publish e-mail certificates to the Global Address List (GAL). + +If you enable this policy setting, the "Publish to GAL" button does not display in the "E-mail Security" section of the Trust Center. + +If you disable or do not configure this policy setting, Outlook users can publish their e-mail certificates to the GAL through the "E-mail Security" section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108889V-99785CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Do not display 'Publish to GAL' button to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Do not display 'Publish to GAL' button is set to "Enabled". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\ outlook\security + +If the value for publishtogaldisabled is REG_DWORD = 1, this is not a finding.SRG-APP-000630<GroupDescription></GroupDescription>O365-OU-000011The minimum encryption key length in Outlook must be at least 168.<VulnDiscussion>This policy setting allows you to set the minimum key length for an encrypted e-mail message. + +If you enable this policy setting, you may set the minimum key length for an encrypted e-mail message. Outlook will display a warning dialog if the user tries to send a message using an encryption key that is below the minimum encryption key value set. The user can still choose to ignore the warning and send using the encryption key originally chosen. + +If you disable or do not configure this policy setting, a dialog warning will be shown to the user if the user attempts to send a message using encryption. The user can still choose to ignore the warning and send using the encryption key originally chosen.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108891V-99787CCI-002450Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Minimum encryption settings to "Enabled"and a Minimum key size (in bits) of "168" or above. +Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Minimum encryption settings is set to "Enabled" and a Minimum key size (in bits) of "168" or above. + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for minenckey is set to 168 or above, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-OU-000012The warning about invalid digital signatures must be enabled to warn Outlook users.<VulnDiscussion>This policy setting controls how Outlook warns users about messages with invalid digital signatures. + +If you enable this policy setting, you can choose from three options for controlling how Outlook users are warned about invalid signatures: +- Let user decide if they want to be warned. This option enforces the default configuration. +- Always warn about invalid signatures. +- Never warn about invalid signatures. + +If you disable or do not configure this policy setting, if users open e-mail messages that include invalid digital signatures, Outlook displays a warning dialog. Users can decide whether they want to be warned about invalid signatures in the future.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108893V-99789CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Warning to "Enabled" "Always warn about invalid signatures".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Warning is set to "Enabled" "Always warn about invalid signatures". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for warnaboutinvalid is set to REG_DWORD = 1, this is not a finding.SRG-APP-000605<GroupDescription></GroupDescription>O365-OU-000013Outlook must be configured to allow retrieving of Certificate Revocation Lists (CRLs) always when online.<VulnDiscussion>This policy setting controls how Outlook retrieves Certificate Revocation Lists to verify the validity of certificates. Certificate revocation lists (CRLs) are lists of digital certificates that have been revoked by their controlling certificate authorities (CAs), typically because the certificates were issued improperly or their associated private keys were compromised. + +If you enable this policy setting, you can choose from three options to govern how Outlook uses CRLs: +- Use system Default. Outlook relies on the CRL download schedule that is configured for the operating system. +- When online always retrieve the CRL. This option is the default configuration in Outlook. +- Never retrieve the CRL. Outlook will not attempt to download the CRL for a certificate, even if it is online. This option can reduce security. + +If you disable or do not configure this policy setting, when Outlook handles a certificate that includes a URL from which a CRL can be downloaded, Outlook will retrieve the CRL from the provided URL if Outlook is online.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108895V-99791CCI-000185Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Status dialog box >> Retrieving CRLs (Certificate Revocation Lists) to "Enabled" "When online always retrieve the CRL".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Status dialog box >> Retrieving CRLs (Certificate Revocation Lists) is set to "Enabled" "When online always retrieve the CRL". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\ outlook\security + +If the value for usecrlchasing is set to REG_DWORD = 1, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-OU-000014The Outlook Security Mode must be enabled to always use the Outlook Security Group Policy.<VulnDiscussion>This policy setting controls which set of security settings are enforced in Outlook. If you enable this policy setting, you can choose from four options for enforcing Outlook security settings: + +- Outlook Default Security - This option is the default configuration in Outlook. Users can configure security themselves, and Outlook ignores any security-related settings configured in Group Policy. +- Use Security Form from "Outlook Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. +- Use Security Form from "Outlook 10 Security Settings" Public Folder - Outlook uses the settings from the security form published in the designated public folder. +- Use Outlook Security Group Policy - Outlook uses security settings from Group Policy. Important: You must enable this policy setting if you want to apply the other Outlook security policy settings mentioned in this guide. If you disable or do not configure this policy setting, Outlook users can configure security for themselves, and Outlook ignores any security-related settings that are configured in Group Policy. + +Note: In previous versions of Outlook, when security settings were published in a form in Exchange Server public folders, users who needed these settings required the HKEY_CURRENT_USER >> Software >> Policies >> Microsoft >> Security >> CheckAdminSettings registry key to be set on their computers for the settings to apply. In Outlook, the CheckAdminSettings registry key is no longer used to determine users' security settings. Instead, the Outlook Security Mode setting can be used to determine whether Outlook security should be controlled directly by Group Policy, by the security form from the Outlook Security Settings Public Folder, or by the settings on users' own computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108897V-99793CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode to "Enabled (Use Outlook Security Group Policy)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Outlook Security Mode is set to "Enabled (Use Outlook Security Group Policy)". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\ outlook\security + +If the value for adminsecuritymode is set to REG_DWORD = 3, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-OU-000015The ability to demote attachments from Level 2 to Level 1 must be disabled.<VulnDiscussion>This policy setting controls whether Outlook users can demote attachments to Level 2 by using a registry key, which will allow them to save files to disk and open them from that location. Outlook uses two levels of security to restrict access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. + +If you enable this policy setting, users can create a list of Level 1 file types to demote to Level 2 by adding the file types to the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security\Level1Remove. + +If you disable or do not configure this policy setting, users cannot demote level 1 attachments to level 2, and the HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security\Level1Remove registry key has no effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108899V-99795CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Allow users to demote attachments to Level 2 to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Allow users to demote attachments to Level 2 is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value allowuserstolowerattachments is set to REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-OU-000016The display of Level 1 attachments must be disabled in Outlook.<VulnDiscussion>This policy setting controls whether Outlook blocks potentially dangerous attachments designated Level 1. Outlook uses two levels of security to restrict users' access to files attached to e-mail messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. + +If you enable this policy setting, Outlook users can gain access to Level 1 file type attachments by first saving the attachments to disk and then opening them, as with Level 2 attachments. If you disable this policy setting, Level 1 attachments do not display under any circumstances. If you do not configure this policy setting, Outlook completely blocks access to Level 1 files, and requires users to save Level 2 files to disk before opening them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108901V-99797CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security "Display Level 1 attachments" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Display Level 1 attachments is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security + +If the value ShowLevel1Attach is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-OU-000017Level 1 file attachments must be blocked from being delivered.<VulnDiscussion>This policy setting controls whether Outlook users can demote attachments to Level 2 by using a registry key, which will allow them to save files to disk and open them from that location. Outlook uses two levels of security to restrict access to files attached to email messages or other items. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. + +If you enable this policy setting, users can create a list of Level 1 file types to demote to Level 2 by adding the file types to the following registry key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level1Remove. + +If this policy setting is disabled or not configured, users cannot demote Level 1 attachments to Level 2, and the HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level1Remove registry key has no effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108903V-99799CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 1 to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 1 is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security\FileExtensionsRemoveLevel1 + +If the registry key exists, this is a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-OU-000018Level 2 file attachments must be blocked from being delivered.<VulnDiscussion>This policy setting controls which types of attachments (determined by file extension) must be saved to disk before users can open them. Files with specific extensions can be categorized as Level 1 (users cannot view the file) or Level 2 (users can open the file after saving it to disk). Users can freely open files of types that are not categorized as Level 1 or Level 2. + +If you enable this policy setting, you can specify a list of attachment file types to classify as Level 2, which forces users to actively decide to download the attachment to view it. + +If you disable or do not configure this policy setting, Outlook does not classify any file type extensions as Level 2. + +Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108905V-99801CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 2 to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Attachment Security >> Remove file extensions blocked as Level 2 is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook \security\FileExtensionsRemoveLevel2 + +If the registry key exists, this is a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-OU-000019Outlook must be configured to not run scripts in forms in which the script and the layout are contained within the message.<VulnDiscussion>This policy setting controls whether scripts can run in Outlook forms in which the script and layout are contained within the message. If you enable this policy setting, scripts can run in one-off Outlook forms. If you disable or do not configure this policy setting, Outlook does not run scripts in forms in which the script and the layout are contained within the message. Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108907V-99803CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Security "Allow scripts in one-off Outlook forms" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Custom Form Security "Allow scripts in one-off Outlook forms" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security + +If the value EnableOneOffFormScripts is REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000020When a custom action is executed that uses the Outlook object model, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls whether Outlook prompts users before executing a custom action. Custom actions add functionality to Outlook that can be triggered as part of a rule. Among other possible features, custom actions can be created that reply to messages in ways that circumvent the Outlook model's programmatic send protections. If you enable this policy setting, you can choose from four options to control how Outlook functions when a custom action is executed that uses the Outlook object model: +- Prompt User +- Automatically Approve +- Automatically Deny +- Prompt user based on computer security. This option enforces the default configuration in Outlook. + +If you disable or do not configure this policy setting, when Outlook or another program initiates a custom action using the Outlook object model, users are prompted to allow or reject the action. If this configuration is changed, malicious code can use the Outlook object model to compromise sensitive information or otherwise cause data and computing resources to be at risk. This is the equivalent of choosing Enabled -- Prompt user based on computer security.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108909V-99805CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Set Outlook object model custom actions execution prompt to "Enabled" and select "Automatically Deny".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Set Outlook object model custom actions execution prompt is set to "Enabled" and "Automatically Deny". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for promptoomcustomaction is set to REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000021When an untrusted program attempts to programmatically access an Address Book using the Outlook object model, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to gain access to an Address Book using the Outlook object model. + +If you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically access an Address Book using the Outlook object model: +- Prompt user - Users are prompted to approve every access attempt. +- Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. +- Automatically deny - Outlook will automatically deny programmatic access requests from any program. +- Prompt user based on computer security - Outlook will rely on the setting in the ''Programmatic Access'' section of the Trust Center. This is the default behavior. + +If you disable or do not configure this policy setting, when an untrusted application attempts to access the address book programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108911V-99807CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when accessing an address book to "Enabled (Automatically Deny)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when accessing an address book is set to "Enabled (Automatically Deny)". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for promptoomaddressbookaccess is set to REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000022When a user designs a custom form in Outlook and attempts to bind an Address Information field to a combination or formula custom field, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls what happens when a user designs a custom form in Outlook and attempts to bind an Address Information field to a combination or formula custom field. If you enable this policy setting, you can choose from four different options when an untrusted program attempts to access address information using the UserProperties. Find method of the Outlook object model: + +- Prompt user. The user will be prompted to approve every access attempt. - Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. +- Automatically deny. Outlook will automatically deny programmatic access requests from any program. +- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. + +If you disable or do not configure this policy setting, when a user tries to bind an address information field to a combination or formula custom field in a custom form, Outlook relies on the setting configured in the "Programmatic Access" section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108913V-99809CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt When accessing the Formula property of a UserProperty object to "Enabled (Automatically Deny)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when accessing the Formula property of a UserProperty object is set to "Enabled (Automatically Deny)". + +Use the Windows Registry to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security + +If the value PromptOOMFormulaAccess is REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000023When an untrusted program attempts to use the Save As command to programmatically save an item, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to use the Save As command to programmatically save an item. + +If you enable this policy setting, you can choose from four different options when an untrusted program attempts to use the Save As command to programmatically save an item: +- Prompt user. The user will be prompted to approve every access attempt. +- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. +- Automatically deny. Outlook will automatically deny programmatic access requests from any program. +- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration. + +If you disable or do not configure this policy setting, when an untrusted application attempts to use the Save As command, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108915V-99811CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when executing Save As to "Enabled (Automatically Deny)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when executing Save As is set to "Enabled (Automatically Deny)". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for promptoomsaveas is set to REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000024When an untrusted program attempts to gain access to a recipient field, such as the, To: field, using the Outlook object model, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to gain access to a recipient field, such as the ''To:'' field, using the Outlook object model. + +If you enable this policy setting, you can choose from four different options when an untrusted program attempts to access a recipient field using the Outlook object model: +- Prompt user. The user will be prompted to approve every access attempt. +- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. +- Automatically deny. Outlook will automatically deny programmatic access requests from any program. +- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. This is the default configuration. + +If you disable or do not configure this policy setting, when an untrusted application attempts to access recipient fields, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108917V-99813CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when reading address information to "Enabled (Automatically Deny)". + +Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when reading address information is set to "Enabled (Automatically Deny)". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for promptoomaddressinformationaccess is set to REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000025When an untrusted program attempts to programmatically send e-mail in Outlook using the Response method of a task or meeting request, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to programmatically send e-mail in Outlook using the Response method of a task or meeting request. + +If you enable this policy setting, you can choose from four different options when an untrusted program attempts to programmatically send e-mail using the Response method of a task or meeting request: +- Prompt user. The user will be prompted to approve every access attempt. +- Automatically approve. Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. +- Automatically deny. Outlook will automatically deny programmatic access requests from any program. +- Prompt user based on computer security. Outlook only prompts users when antivirus software is out of date or not running. This is the default configuration. + +If you disable or do not configure this policy setting, when an untrusted application attempts to respond to tasks or meeting requests programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108919V-99815CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when responding to meeting and task requests to "Enabled (Automatically Deny)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when responding to meeting and task requests is set to "Enabled (Automatically Deny)" + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for promptoommeetingtaskrequestresponse is set to REG_DWORD = 0, this is not a finding.SRG-APP-000488<GroupDescription></GroupDescription>O365-OU-000026When an untrusted program attempts to send e-mail programmatically using the Outlook object model, Outlook must automatically deny it.<VulnDiscussion>This policy setting controls what happens when an untrusted program attempts to send e-mail programmatically using the Outlook object model. + +If you enable this policy setting, you can choose from four different options when an untrusted program attempts to send e-mail programmatically using the Outlook object model: +- Prompt user - The user will be prompted to approve every access attempt. +- Automatically approve - Outlook will automatically grant programmatic access requests from any program. This option can create a significant vulnerability, and is not recommended. +- Automatically deny - Outlook will automatically deny programmatic access requests from any program. +- Prompt user based on computer security. Outlook will only prompt users when antivirus software is out of date or not running. + +Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy". + +If you disable or do not configure this policy setting, when an untrusted application attempts to send mail programmatically, Outlook relies on the setting configured in the ''Programmatic Access'' section of the Trust Center.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108921V-99817CCI-002460Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when sending mail to "Enabled (Automatically Deny)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Security Form Settings >> Programmatic Security >> Configure Outlook object model prompt when sending mail is set to "Enabled (Automatically Deny)". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for promptoomsend is set to REG_DWORD = 0, this is not a finding.SRG-APP-000516<GroupDescription></GroupDescription>O365-OU-000027Outlook must be configured to not allow hyperlinks in suspected phishing messages.<VulnDiscussion>This policy setting controls whether hyperlinks in suspected phishing e-mail messages in Outlook are allowed. If you enable this policy setting, Outlook will allow hyperlinks in suspected phishing messages that are not also classified as junk e-mail. If you disable or do not configure this policy setting, Outlook will not allow hyperlinks in suspected phishing messages, even if they are not classified as junk e-mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108923V-99819CCI-000366Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center "Allow hyperlinks in suspected phishing e-mail messages" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center "Allow hyperlinks in suspected phishing e-mail messages" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + +If the value JunkMailEnableLinks is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-OU-000028The Security Level for macros in Outlook must be configured to Warn for signed and disable unsigned.<VulnDiscussion>This policy setting controls the security level for macros in Outlook. + +If you enable this policy setting, you can choose from four options for handling macros in Outlook: +- Always warn. This option corresponds to the "Warnings for all macros" option in the "Macro Security" section of the Outlook Trust Center. Outlook disables all macros that are not opened from a trusted location, even if the macros are signed by a trusted publisher. For each disabled macro, Outlook displays a security alert dialog box with information about the macro and its digital signature (if present), and allows users to enable the macro or leave it disabled. +- Never warn, disable all. This option corresponds to the "No warnings and disable all macros" option in the Trust Center. Outlook disables all macros that are not opened from trusted locations, and does not notify users. +- Warning for signed, disable unsigned. This option corresponds to the "Warnings for signed macros; all unsigned macros are disabled" option in the Trust Center. Outlook handles macros as follows: +--If a macro is digitally signed by a trusted publisher, the macro can run if the user has already trusted the publisher. +--If a macro has a valid signature from a publisher that the user has not trusted, the security alert dialog box for the macro lets the user choose whether to enable the macro for the current session, disable the macro for the current session, or to add the publisher to the Trusted Publishers list so that it will run without prompting the user in the future. +--If a macro does not have a valid signature, Outlook disables it without prompting the user, unless it is opened from a trusted location. +This option is the default configuration in Outlook. +- No security check. This option corresponds to the "No security check for macros (Not recommended)" option in the Trust Center. Outlook runs all macros without prompting users. This configuration makes users' computers vulnerable to potentially malicious code and is not recommended. + +If you disable or do not configure this policy setting, the behavior is the equivalent of Enabled -- Warning for signed, disable unsigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108925V-99821CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center >> Security setting for macros must to "Enabled: Warn for signed, disable unsigned".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Trust Center >> Security setting for macros must be set to "Enabled: Warn for signed, disable unsigned". + +Use the Windows Registry to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\outlook\security + +If the value for level is set to REG_DWORD = 3, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PR-000001Trusted Locations on the network must be disabled in Project.<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. + +If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. + +If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. + +If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. + +Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting as the "Allow Trusted Locations on my network (not recommended)" check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users. + +If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108955V-99851CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> Allow Trusted Locations on the network to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> Allow Trusted Locations on the network is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\ms project\security\trusted locations + +If the value allownetworklocations is REG_DWORD = 0, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-PR-000002Project must automatically disable unsigned add-ins without informing users.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108957V-99853CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Project 2016 >> Project Options >> Security >> Trust Center >> "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\Microsoft\office\16.0\ms project\security + +If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-PR-000003VBA Macros not digitally signed must be blocked in Project.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected. + +If you disable this policy setting, "Disable all with notification" will be the default setting. + +If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document. + +Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases. + +Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. + +Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108959V-99855CCI-000381Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> VBA Macro Notification Settings to "Enabled" "Disable all except digitally signed macros".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Enabled" "Disable all except digitally signed macros". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\project\security + +If the value for vbawarnings is REG_DWORD = 1, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-PT-000001VBA Macros not digitally signed must be blocked in PowerPoint.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected. + +If you disable this policy setting, "Disable all with notification" will be the default setting. + +If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document. + +Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases. + +Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. + +Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108929V-99825CCI-000381Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> VBA Macro Notification Settings to "Enabled" "Disable all except digitally signed macros".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Enabled" "Disable all except digitally signed macros". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\powerpoint\security + +If the value for vbawarnings is REG_DWORD = 0, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PT-000002The ability to run programs from PowerPoint must be disabled.<VulnDiscussion>This policy setting controls the prompting and activation behavior for the "Run Programs" option for action buttons in PowerPoint. + +If you enable this policy setting, you can choose from three options to control how the "Run Programs" option functions: +- Disable (do not run any programs). If users click an action button with the "Run Programs" action assigned to it, nothing will happen. This option enforces the default configuration in PowerPoint.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108931V-99827CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Run Programs to "Enabled" "Disable (do not run any programs)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Run Programs is set to "Enabled" "Disable (do not run any programs)". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\powerpoint\security + +If the value runprograms does not exist, this is not a finding. If the value is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-PT-000003Open/Save of PowerPoint 97-2003 presentations, shows, templates, and add-in files must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save PowerPoint files with the format specified by the title of this policy setting. + +If you enable this policy setting, you can specify whether users can open, view, edit, or save files. + +The options that can be selected are below. Note: Not all options may be available for this policy setting. +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108933V-99829CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings >> PowerPoint 97-2003 presentations, shows, templates and add-in files to "Enabled" "Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings >> PowerPoint 97-2003 presentations, shows, templates and add-in files is set to "Enabled" "Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\powerpoint\security\fileblock + +If the value for binaryfiles is set to REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-PT-000004The default file block behavior must be set to not open blocked files in PowerPoint.<VulnDiscussion>This policy setting allows you to determine if users can open, view, or edit Word files. If you enable this policy setting, you can set one of these options: +- Blocked files are not opened. +- Blocked files open in Protected View and cannot be edited. +- Blocked files open in Protected View and can be edited. + +If you disable or do not configure this policy setting, the behavior is the same as the "Blocked files are not opened" setting. Users will not be able to open blocked files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108935V-99831CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" to "Enabled: Blocked files are not opened".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" is set to "Enabled: Blocked files are not opened". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\fileblock + +If the value OpenInProtectedView is REG_DWORD = 0, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PT-000005Encrypted macros in PowerPoint Open XML presentations must be scanned.<VulnDiscussion>This policy setting controls whether encrypted macros in Open XML presentations are required to be scanned with anti-virus software before being opened. If you enable this policy setting, you may choose one of these options: + +- Scan encrypted macros: Encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted presentation that contains macros. +- Scan if anti-virus software available: If anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load. +- Load macros without scanning: Do not check for anti-virus software and allow macros to be loaded in an encrypted file. If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108937V-99833CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Scan encrypted macros in PowerPoint Open XML presentations" to "Enabled" and "Scan encrypted macros".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Scan encrypted macros in PowerPoint Open XML presentations" is set to "Enabled" and "Scan encrypted macros". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security + +If the value PowerPointBypassEncryptedMacroScan does not exist, this is not a finding. + +If the value is REG_DWORD = 0, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PT-000006File validation in PowerPoint must be enabled.<VulnDiscussion>This policy setting allows you to turn off the file validation feature. If you enable this policy setting, file validation will be turned off. If you disable or do not configure this policy setting, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform against the file format schema before they are opened.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108939V-99835CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Turn off file validation" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security "Turn off file validation" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\filevalidation + +If the value EnableOnLoad is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PT-000007Macros from the Internet must be blocked from running in PowerPoint.<VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. If you enable this policy setting, macros are blocked from running, even if "Enable all macros" is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to "Enable Content", users will receive a notification that macros are blocked from running. + +If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108941V-99837CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\powerpoint\security + +If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-PT-000008Unsigned add-ins in PowerPoint must be blocked with no Trust Bar Notification to the user.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108943V-99839CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center "Disable Trust Bar Notification for unsigned application add-ins and block them" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\Microsoft\office\16.0\powerpoint\security + +If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-PT-000009Files downloaded from the Internet must be opened in Protected view in PowerPoint.<VulnDiscussion>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View. If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View. If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108945V-99841CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files from the Internet zone in Protected View" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files from the Internet zone in Protected View" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\protectedview + +If the value DisableInternetFilesInPV is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-PT-000010PowerPoint attachments opened from Outlook must be in Protected View.<VulnDiscussion>This policy setting allows for determining whether PowerPoint files in Outlook attachments open in Protected View. If enabling this policy setting, Outlook attachments do not open in Protected View. If disabling or not configuring this policy setting, Outlook attachments open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108947V-99843CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Turn off Protected View for attachments opened from Outlook" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Turn off Protected View for attachments opened from Outlook" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\protectedview + +If the value DisableAttachmentsInPV is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-PT-000011Files in unsafe locations must be opened in Protected view in PowerPoint.<VulnDiscussion>This policy setting determines whether files located in unsafe locations will open in Protected View. If unsafe locations have not been specified, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations. If enabling this policy setting, files located in unsafe locations do not open in Protected View. If disabling or not configuring this policy setting, files located in unsafe locations open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108949V-99845CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files in unsafe locations in Protected View" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View "Do not open files in unsafe locations in Protected View" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\protectedview + +If the value DisableUnsafeLocationsInPV is REG_DWORD = 0, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PT-000012If file validation fails, files must be opened in Protected view in PowerPoint with ability to edit disabled.<VulnDiscussion>This policy setting controls how Office handles documents when they fail file validation. If you enable this policy setting, you can configure the following options for files that fail file validation: + +- Block files completely. Users cannot open the files. +- Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting. +- Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting. + +If you disable this policy setting, Office follows the "Open files in Protected View and disallow edit" behavior. If you do not configure this policy setting, Office follows the "Open files in Protected View and allow edit" behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108951V-99847CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails to "Enabled: Open in Protected View". + +Uncheck the "Allow edit" check box.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails is set to "Enabled: Open in Protected View". Verify the check box for "Allow edit" is not selected. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\filevalidation + +If the value openinprotectedview does not exist, this is not a finding. + +If both the value for openinprotectedview is REG_DWORD = 1 and the value for DisableEditFromPV is set to REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-PT-000013The use of network locations must be ignored in PowerPoint.<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. + +If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. + +Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. It is recommended that you do not enable this policy setting, as the "Allow Trusted Locations on my network (not recommended) check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users. If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108953V-99849CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft PowerPoint 2016 >> PowerPoint Options >> Security >> Trust Center >> Trusted Locations "Allow Trusted Locations on the network" is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\security\trusted locations + +If the value AllowNetworkLocations is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-PU-000001Publisher must be configured to prompt the user when another application programmatically opens a macro.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108961V-99857CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Publisher Automation Security Level to "Enabled" "By UI (prompted)"Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Publisher Automation Security Level is set to "Enabled" "By UI (prompted)". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\common\security + +If the value automationsecuritypublisher is REG_DWORD = 0, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-PU-000002Publisher must automatically disable unsigned add-ins without informing users.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108963V-99859CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\publisher\security + +If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-PU-000003Publisher must disable all unsigned VBA macros.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected. + +If you disable this policy setting, "Disable all with notification" will be the default setting. + +If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document. + +Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases. + +Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. + +Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108965V-99861CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016\Security >> Trust Center >> VBA Macro Notification Settings >> VBA Macro Notification Settings must to Disable all except digitally signed macros.Set policy value for User Configuration >> Administrative Templates >> Microsoft Publisher 2016 >> Security >> Trust Center >> VBA Macro Notification Settings >> VBA Macro Notification Settings to "Enabled" "Disable all except digitally signed macros" + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\publisher\security + +If the value vbawarnings is REG_DWORD = 1, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-VI-000001VBA Macros not digitally signed must be blocked in Visio.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected. + +If you disable this policy setting, "Disable all with notification" will be the default setting. + +If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar. If the user clicks "Enable Content", then the document is added as a trusted document. + +Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases. + +Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. + +Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108967V-99863CCI-000381Set the policy value for User Configuration >> Administrative Templates/Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> VBA Macro Notification Settings to "Enabled" and select "Disable all except digitally signed macros".Verify the policy value for User Configuration >> Administrative Templates/Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> VBA Macro Notification Settings is set to "Enabled" and "Disable all except digitally signed macros". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\visio\security + +If the value for vbawarnings is REG_DWORD = 3, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-VI-000002Trusted Locations on the network must be disabled in Visio.<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. + +If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. + +If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. + +If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. + +Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting as the "Allow Trusted Locations on my network (not recommended)" check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users. + +If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108969V-99865CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Allow Trusted Locations on the network to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Allow Trusted Locations on the network is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\visio\security\trusted locations + +If the value for allownetworklocations is REG_DWORD = 0, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-VI-000003Visio must automatically disable unsigned add-ins without informing users.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108971V-99867CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them to Enabled.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them is set to Enabled. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\visio\security + +If the value notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-VI-000004Visio 2000-2002 Binary Drawings, Templates and Stencils must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting. + +If you enable this policy setting, you can specify whether users can open or save files. + +The options that can be selected are below. Note: Not all options may be available for this policy setting. + +-Do not block: The file type will not be blocked. +-Save blocked: Saving of the filet type will be blocked. +-Open/Save blocked: Both opening and saving of the file type will be blocked. + +If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108973V-99869CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2000-2002 Binary Drawings, Templates and Stencils" to "Enabled" and "Open/Save blocked".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2000-2002 Binary Drawings, Templates and Stencils" is set to "Enabled" and "Open/Save blocked". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\visio\security\fileblock + +If the value "visio2000files" is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-VI-000005Visio 2003-2010 Binary Drawings, Templates and Stencils must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting. + +If you enable this policy setting, you can specify whether users can open or save files. + +The options that can be selected are below. Note: Not all options may be available for this policy setting. + +-Do not block: The file type will not be blocked. +-Save blocked: Saving of the filet type will be blocked. +-Open/Save blocked: Both opening and saving of the file type will be blocked. + +If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108975V-99871CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2003-2010 Binary Drawings, Templates and Stencils" to "Enabled" and "Open/Save blocked".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 2003-2010 Binary Drawings, Templates and Stencils" is set to "Enabled" and "Open/Save blocked". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\visio\security\fileblock + +If the value "visio2003files" is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-VI-000006Visio 5.0 or earlier Binary Drawings, Templates and Stencils must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open or save Visio files with the format specified by the title of this policy setting. + +If you enable this policy setting, you can specify whether users can open or save files. + +The options that can be selected are below. Note: Not all options may be available for this policy setting. + +-Do not block: The file type will not be blocked. +-Save blocked: Saving of the filet type will be blocked. +-Open/Save blocked: Both opening and saving of the file type will be blocked. + +If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108977V-99873CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 5.0 or earlier Binary Drawings, Templates and Stencils" to "Enabled" and "Open/Save blocked".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> File Block Settings "Visio 5.0 or earlier Binary Drawings, Templates and Stencils" is set to "Enabled" and "Open/Save blocked". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\visio\security\fileblock + +If the value "visio50andearlierfiles" is REG_DWORD = 2, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-VI-000007Macros must be blocked from running in Visio files from the Internet.<VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. + +If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content”, users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. + +If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108979V-99875CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Visio 2016 >> Visio Options >> Security >> Trust Center >> Block macros from running in Office files from the Internet is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\visio\security + +If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.SRG-APP-000131<GroupDescription></GroupDescription>O365-WD-000001Word must automatically disable unsigned add-ins without informing users.<VulnDiscussion>This policy setting controls whether the specified Office application notifies users when unsigned application add-ins are loaded or silently disable such add-ins without notification. This policy setting only applies if you enable the "Require that application add-ins are signed by Trusted Publisher" policy setting, which prevents users from changing this policy setting. + +If you enable this policy setting, applications automatically disable unsigned add-ins without informing users. + +If you disable this policy setting, if this application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in. + +If you do not configure this policy setting, the disable behavior applies, and in addition, users can configure this requirement themselves in the "Add-ins" category of the Trust Center for the application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108981V-99877CCI-001749Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Disable Trust Bar Notification for unsigned application add-ins and block them is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security + +If the value for notbpromptunsignedaddin is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-WD-000002In Word, encrypted macros must be scanned.<VulnDiscussion>This policy setting controls whether encrypted macros in Open XML documents be are required to be scanned with anti-virus software before being opened. + +If you enable this policy setting, you may choose one of these options: +- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed. Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros. +- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load. If anti-virus software is not available, allow encrypted macros to load. +- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file. + +If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108983V-99879CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Scan encrypted macros in Word Open XML documents to "Enabled" "Scan encrypted macros (default)".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Scan encrypted macros in Word Open XML documents is set to "Enabled" "Scan encrypted macros (default)". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security + +If the value WordBypassEncryptedMacroScan does not exist, this is not a finding. If the value is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000003Files downloaded from the Internet must be opened in Protected view in Word.<VulnDiscussion>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View. + +If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View. + +If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108985V-99881CCI-001662Set the policy setting, User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View to "Disabled".Verify the policy setting, User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files from the Internet zone in Protected View is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security\protectedview + +If the value for disableinternetfilesinpv is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. + +If the value is REG_DWORD = 1, this is a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000004Files located in unsafe locations must be opened in Protected view in Word.<VulnDiscussion>This policy setting lets you determine if files located in unsafe locations will open in Protected View. If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations. + +If you enable this policy setting, files located in unsafe locations do not open in Protected View. + +If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108987V-99883CCI-001662Set the policy setting, User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Do not open files in unsafe locations in Protected View is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security\protectedview. + +If the value for disableunsafelocationsinpv is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. + +If the value is REG_DWORD = 1, this is a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000005If file validation fails, files must be opened in Protected view in Word with ability to edit disabled.<VulnDiscussion>This policy setting controls how Office handles documents when they fail file validation. + +If you enable this policy setting, you can configure the following options for files that fail file validation: +- Block files completely. Users cannot open the files. +- Open files in Protected View and disallow edit. Users cannot edit the files. This is also how Office handles the files if you disable this policy setting. +- Open files in Protected View and allow edit. Users can edit the files. This is also how Office handles the files if you do not configure this policy setting. + +If you disable this policy setting, Office follows the "Open files in Protected View and disallow edit" behavior. + +If you do not configure this policy setting, Office follows the "Open files in Protected View and allow edit" behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108989V-99885CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails to "Enabled: Open in Protected View". + +Uncheck the "Allow edit" check box.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Protected View >> Set document behavior if file validation fails is set to "Enabled: Open in Protected View". Verify the check box for "Allow edit" is not selected. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\Word\security\filevalidation + +If the value openinprotectedview does not exist, this is not a finding. + +If both the value for openinprotectedview is REG_DWORD = 1 and the value for DisableEditFromPV is set to REG_DWORD = 1, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000006Word attachments opened from Outlook must be in Protected View.<VulnDiscussion>This policy setting allows you to determine if Word files in Outlook attachments open in Protected View. + +If you enable this policy setting, Outlook attachments do not open in Protected View. + +If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108991V-99887CCI-001662Set policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security>> Trust Center>> Protected View >> Turn off Protected View for attachments opened from Outlook to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security>> Trust Center>> Protected View >> Turn off Protected View for attachments opened from Outlook is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security\protectedview + +If the value for disableattachmentsinpv is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000007The default file block behavior must be set to not open blocked files in Word.<VulnDiscussion>This policy setting allows you to determine if users can open, view, or edit Word files. + +If you enable this policy setting, you can set one of these options: +- Blocked files are not opened. +- Blocked files open in Protected View and cannot be edited. +- Blocked files open in Protected View and can be edited. + +If you disable or do not configure this policy setting, the behavior is the same as the "Blocked files are not opened" setting. Users will not be able to open blocked files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108993V-99889CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" to "Enabled: Blocked files are not opened".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Set default file block behavior" is set to "Enabled: Blocked files are not opened". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value OpenInProtectedView is REG_DWORD = 0, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000008Open/Save of Word 2 and earlier binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108995V-99891CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2 and earlier binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2 and earlier binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value Word2Files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000009Open/Save of Word 2000 binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108997V-99893CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2000 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2000 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value Word2000Files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000010Open/Save of Word 2003 binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-108999V-99895CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2003 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2003 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value word2003files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000011Open/Save of Word 2007 and later binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109001V-99897CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2007 and later binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 2007 and later binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value word2007files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000012Open/Save of Word 6.0 binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109003V-99899CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 6.0 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 6.0 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value word60files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000013Open/Save of Word 95 binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109005V-99901CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 95 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 95 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value word95files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000014Open/Save of Word 97 binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109007V-99903CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 97 binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word 97 binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value word97files is REG_DWORD = 2, this is not a finding.SRG-APP-000207<GroupDescription></GroupDescription>O365-WD-000015Open/Save of Word XP binary documents and templates must be blocked.<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Word files with the format specified by the title of this policy setting. If you enable this policy setting, you can specify whether users can open, view, edit, or save files. The options that can be selected are below. Note: Not all options may be available for this policy setting. + +- Do not block: The file type will not be blocked. +- Save blocked: Saving of the file type will be blocked. +- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key. +- Block: Both opening and saving of the file type will be blocked, and the file will not open. +- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled. +- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled. + +If you disable or do not configure this policy setting, the file type will not be blocked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109009V-99905CCI-001662Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word XP binary documents and templates" to "Enabled: Open/Save blocked, use open policy".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> File Block Settings "Word XP binary documents and templates" is set to "Enabled: Open/Save blocked, use open policy". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security\fileblock + +If the value wordxpfiles is REG_DWORD = 2, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-WD-000016In Word, macros must be blocked from running, even if Enable all macros is selected in the Macro Settings section of the Trust Center.<VulnDiscussion>This policy setting allows you to block macros from running in Office files that come from the Internet. If you enable this policy setting, macros are blocked from running, even if "Enable all macros" is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to "Enable Content", users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run. + +If you disable or do not configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109011V-99907CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" to "Enabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center "Block macros from running in Office files from the Internet" is set to "Enabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\Software\Policies\Microsoft\Office\16.0\word\security + +If the value blockcontentexecutionfrominternet is REG_DWORD = 1, this is not a finding.SRG-APP-000210<GroupDescription></GroupDescription>O365-WD-000017Trusted Locations on the network must be disabled in Word.<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. + +If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. + +If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. + +If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers. + +Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center. We recommended that you do not enable this policy setting as the "Allow Trusted Locations on my network (not recommended)" check box also states. Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users. + +If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109013V-99909CCI-001170Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Trusted Locations >> Allow Trusted Locations on the network to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Trust Center >> Trusted Locations >> Allow Trusted Locations on the network is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security\trusted locations + +If the value for allownetworklocations is REG_DWORD = 0, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>O365-WD-000018VBA Macros not digitally signed must be blocked in Word.<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present. + +If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros: + +- Disable all with notification: The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office. +- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified. +- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users. +- Enable all macros (not recommended): All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109015V-99911CCI-000381Set the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Security >> Trust Center >> "VBA macro Notification Settings" to "Enabled" and "Disable all except digitally signed macros" from the Options.Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Security >> Trust Center >> "VBA macro Notification Settings" is set to "Enabled" and "Disable all except digitally signed macros" from the Options. + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\Microsoft\office\16.0\word\security + +If the value vbawarnings is REG_DWORD = 3, this is not a finding.SRG-APP-000112<GroupDescription></GroupDescription>O365-WD-000019File validation in Word must be enabled.<VulnDiscussion>This policy setting allows the file validation feature to be turned off. + +If this policy setting is enabled, file validation will be turned off. + +If this policy setting is disabled or not configured, file validation will be turned on. Office Binary Documents (97-2003) are checked to see if they conform to the file format schema before they are opened.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Microsoft Office 365 ProPlusDISADPMS TargetMicrosoft Office 365 ProPlus4099SV-109621V-100517CCI-001695Set policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Turn off file validation to "Disabled".Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Word 2016 >> Word Options >> Security >> Turn off file validation is set to "Disabled". + +Use the Windows Registry Editor to navigate to the following key: + +HKCU\software\policies\microsoft\office\16.0\word\security\filevalidation + +If the value for enableonload is REG_DWORD = 1, this is not a finding. diff --git a/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R2_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R2_Manual-xccdf.xml index d1c09211c..fd3f576aa 100644 --- a/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R2_Manual-xccdf.xml +++ b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R2_Manual-xccdf.xml @@ -1,205 +1,205 @@ -acceptedMS SQL Server 2016 Instance Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 22 Jan 20213.2.1.416661.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000001-DB-000031<GroupDescription></GroupDescription>SQL6-D0-003600SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.<VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. - -This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts; and it does not deal with the total number of sessions across all accounts. - -The capability to limit the number of concurrent sessions per user must be configured in or added to SQL Server (for example, by use of a logon trigger), when this is technically feasible. Note that it is not sufficient to limit sessions via a web server or application server alone, because legitimate users and adversaries can potentially connect to SQL Server by other means. - -The organization will need to define the maximum number of concurrent sessions by account type, by account, or a combination thereof. In deciding on the appropriate number, it is important to consider the work requirements of the various types of users. For example, 2 might be an acceptable limit for general users accessing the database via an application; but 10 might be too few for a database administrator using a database management GUI tool, where each query tab and navigation pane may count as a separate session. - -(Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93825V-79119CCI-000054Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users. - -CREATE TRIGGER SQL_STIG_Connection_Limit -ON ALL SERVER WITH EXECUTE AS 'sa' --Make sure to use the renamed SA account here. -FOR LOGON -AS -BEGIN - IF (SELECT COUNT(1) - FROM sys.dm_exec_sessions - WHERE is_user_process = 1 - And original_login_name = ORIGINAL_LOGIN() - ) > 1000 --Organizationally defined number - BEGIN - PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded the concurrent session limit.' - ROLLBACK; - END -END; - -Reference: https://msdn.microsoft.com/en-us/library/ms189799.aspxReview the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. - -If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. - -Otherwise, determine if a logon trigger exists: - -In SQL Server Management Studio's Object Explorer tree: -Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers - -OR - -Run the query: -SELECT name FROM master.sys.server_triggers; - -If no triggers are listed, this is a finding. - -If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. - -Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. - -Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003700SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. - -A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. - -Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. - -SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. - +acceptedMS SQL Server 2016 Instance Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 22 Jan 20213.2.1.416661.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000001-DB-000031<GroupDescription></GroupDescription>SQL6-D0-003600SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.<VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. + +This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts; and it does not deal with the total number of sessions across all accounts. + +The capability to limit the number of concurrent sessions per user must be configured in or added to SQL Server (for example, by use of a logon trigger), when this is technically feasible. Note that it is not sufficient to limit sessions via a web server or application server alone, because legitimate users and adversaries can potentially connect to SQL Server by other means. + +The organization will need to define the maximum number of concurrent sessions by account type, by account, or a combination thereof. In deciding on the appropriate number, it is important to consider the work requirements of the various types of users. For example, 2 might be an acceptable limit for general users accessing the database via an application; but 10 might be too few for a database administrator using a database management GUI tool, where each query tab and navigation pane may count as a separate session. + +(Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93825V-79119CCI-000054Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users. + +CREATE TRIGGER SQL_STIG_Connection_Limit +ON ALL SERVER WITH EXECUTE AS 'sa' --Make sure to use the renamed SA account here. +FOR LOGON +AS +BEGIN + IF (SELECT COUNT(1) + FROM sys.dm_exec_sessions + WHERE is_user_process = 1 + And original_login_name = ORIGINAL_LOGIN() + ) > 1000 --Organizationally defined number + BEGIN + PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded the concurrent session limit.' + ROLLBACK; + END +END; + +Reference: https://msdn.microsoft.com/en-us/library/ms189799.aspxReview the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. + +If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. + +Otherwise, determine if a logon trigger exists: + +In SQL Server Management Studio's Object Explorer tree: +Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers + +OR + +Run the query: +SELECT name FROM master.sys.server_triggers; + +If no triggers are listed, this is a finding. + +If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. + +Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. + +Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003700SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. + +A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. + +Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. + +SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. + Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93827V-79121CCI-000015If mixed mode is required, document the need and justification; describe the measures taken to ensure the use of SQL Server authentication is kept to a minimum; describe the measures taken to safeguard passwords; list or describe the SQL Logins used. -Risk must be accepted by the ISSO/ISSM. - -If mixed mode is not required, disable it as follows: - -In the SSMS Object Explorer, right-click on the server instance. -Select "Properties". -Select the Security page. -Click on the radio button for "Windows Authentication Mode". -Click on "OK". -Restart the SQL Server instance. - -OR - -Run the statement: -USE [master] -EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2 -GO - -Restart the SQL Server instance. - -For each account being managed by SQL Server but not requiring it, drop or disable the SQL Login. Replace it with an appropriately configured account, as needed. - -To drop or disable a Login in the SSMS Object Explorer: -Navigate to "Security Logins". -Right-click on the Login name; click on "Delete" or "Disable". - -To drop or disable a Login by using a query: -USE master; -DROP LOGIN login_name; -ALTER LOGIN login_name DISABLE; - -Dropping a Login does not delete the equivalent database User(s). There may be more than one database containing a User mapped to the Login. Drop the User(s) unless still needed. - -To drop a User in the SSMS Object Explorer: -Navigate to Databases >> Security Users. -Right-click on the User name. -Click "Delete". - -To drop a User via a query: -USE database_name; -DROP USER <user_name>;Determine whether SQL Server is configured to use only Windows authentication. - -In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. -Select "Properties". -Select the Security page. - -If Windows Authentication Mode is selected, this is not a finding. - -OR - -In a query interface such as the SSMS Transact-SQL editor, run the statement: -SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') -WHEN 1 THEN 'Windows Authentication' -WHEN 0 THEN 'Windows and SQL Server Authentication' -END as [Authentication Mode] - -If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. - -Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved, this is a finding. - -From the documentation, obtain the list of accounts authorized to be managed by SQL Server. - -Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement: - -SELECT name -FROM sys.sql_logins -WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0; - -If any accounts listed by the query are not listed in the documentation, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003800SQL Server must be configured to utilize the most-secure authentication method available.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. - -A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. - -Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. - -SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. - -Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements. - -SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93829V-79123CCI-000015Ensure Service Principal Names (SPNs) are properly registered for the SQL Server instance. - -Utilize the Microsoft Kerberos Configuration Manager to review Kerberos configuration issues for a given SQL Server instance. - -https://www.microsoft.com/en-us/download/details.aspx?id=39046 - -Alternatively, SPNs for SQL Server can be manually registered. +Risk must be accepted by the ISSO/ISSM. + +If mixed mode is not required, disable it as follows: + +In the SSMS Object Explorer, right-click on the server instance. +Select "Properties". +Select the Security page. +Click on the radio button for "Windows Authentication Mode". +Click on "OK". +Restart the SQL Server instance. + +OR + +Run the statement: +USE [master] +EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2 +GO + +Restart the SQL Server instance. + +For each account being managed by SQL Server but not requiring it, drop or disable the SQL Login. Replace it with an appropriately configured account, as needed. + +To drop or disable a Login in the SSMS Object Explorer: +Navigate to "Security Logins". +Right-click on the Login name; click on "Delete" or "Disable". + +To drop or disable a Login by using a query: +USE master; +DROP LOGIN login_name; +ALTER LOGIN login_name DISABLE; + +Dropping a Login does not delete the equivalent database User(s). There may be more than one database containing a User mapped to the Login. Drop the User(s) unless still needed. + +To drop a User in the SSMS Object Explorer: +Navigate to Databases >> Security Users. +Right-click on the User name. +Click "Delete". + +To drop a User via a query: +USE database_name; +DROP USER <user_name>;Determine whether SQL Server is configured to use only Windows authentication. + +In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. +Select "Properties". +Select the Security page. + +If Windows Authentication Mode is selected, this is not a finding. + +OR + +In a query interface such as the SSMS Transact-SQL editor, run the statement: +SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') +WHEN 1 THEN 'Windows Authentication' +WHEN 0 THEN 'Windows and SQL Server Authentication' +END as [Authentication Mode] + +If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. + +Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved, this is a finding. + +From the documentation, obtain the list of accounts authorized to be managed by SQL Server. + +Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement: + +SELECT name +FROM sys.sql_logins +WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0; + +If any accounts listed by the query are not listed in the documentation, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003800SQL Server must be configured to utilize the most-secure authentication method available.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. + +A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. + +Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. + +SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. + +Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements. + +SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93829V-79123CCI-000015Ensure Service Principal Names (SPNs) are properly registered for the SQL Server instance. + +Utilize the Microsoft Kerberos Configuration Manager to review Kerberos configuration issues for a given SQL Server instance. + +https://www.microsoft.com/en-us/download/details.aspx?id=39046 + +Alternatively, SPNs for SQL Server can be manually registered. For other connections that support Kerberos the SPN is registered in the format MSSQLSvc/<FQDN>/<instancename> for a named instance. The format for registering the default instance is MSSQLSvc/<FQDN>. -Using an account with permissions to register SPNs, issue the following commands from a command-prompt: +Using an account with permissions to register SPNs, issue the following commands from a command-prompt: -setspn -S MSSQLSvc/<Fully Qualified Domain Name> <Service Account> -setspn -S MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> <Service Account> +setspn -S MSSQLSvc/<Fully Qualified Domain Name> <Service Account> +setspn -S MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> <Service Account> For a named instance, use: -setspn -S MSSQLSvc/<FQDN>/<instancename> <Service Account> +setspn -S MSSQLSvc/<FQDN>/<instancename> <Service Account> setspn -S MSSQLSvc/<FQDN>/<instancename>:<TCP Port> <Service Account> -Restart the SQL Server instance. +Restart the SQL Server instance. -More information regarding this process is available at: -https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections#ManualIf the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. +More information regarding this process is available at: +https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections#ManualIf the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. -Obtain the fully qualified domain name of the SQL Server instance: +Obtain the fully qualified domain name of the SQL Server instance: -Launch Windows Explorer. +Launch Windows Explorer. -Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". +Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". -Note the value shown for "Full computer name". +Note the value shown for "Full computer name". -*** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** +*** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** -Obtain the TCP port that is supporting the SQL Server instance: +Obtain the TCP port that is supporting the SQL Server instance: -Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". +Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". -From the tree on the left, expand "SQL Server Network Configuration". +From the tree on the left, expand "SQL Server Network Configuration". -Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). +Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). -In the right pane, right-click on "TCP/IP" and choose "Properties". +In the right pane, right-click on "TCP/IP" and choose "Properties". -In the window that opens, click the "IP Addresses" tab. +In the window that opens, click the "IP Addresses" tab. -Note the TCP port configured for the instance. +Note the TCP port configured for the instance. -Obtain the service account that is running the SQL Server service: +Obtain the service account that is running the SQL Server service: -Click "Start". -Type "SQL Server 2016 Configuration Manager". -From the search results, click "SQL Server 2016 Configuration Manager". +Click "Start". +Type "SQL Server 2016 Configuration Manager". +From the search results, click "SQL Server 2016 Configuration Manager". -From the tree on the left, select "SQL Server Services". +From the tree on the left, select "SQL Server Services". -Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. +Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. -Launch a command-line or PowerShell window. +Launch a command-line or PowerShell window. -Enter the following command where <Service Account> is the identity of the service account. +Enter the following command where <Service Account> is the identity of the service account. -setspn -L <Service Account> +setspn -L <Service Account> -Example: setspn -L CONTOSO\sql2016svc +Example: setspn -L CONTOSO\sql2016svc -Review the Registered Service Principal Names returned. +Review the Registered Service Principal Names returned. -If the listing does not contain the following supported service principal names (SPN) formats, this is a finding. +If the listing does not contain the following supported service principal names (SPN) formats, this is a finding. Named instance MSSQLSvc/<FQDN>:[<port> | <instancename>], where: @@ -214,52 +214,52 @@ Default instance <FQDN> is the fully qualified domain name of the server. <port> is the TCP port number. -If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-003900SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.<VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies. - -Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. - -Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. - -This requirement is applicable to access control enforcement applications, a category that includes database management systems. If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93831V-79125CCI-000213Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them into line with the documented requirements.Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. - -Review the permissions actually in place on the server. - -If the actual permissions do not match the documented requirements, this is a finding. - -Use the supplemental file "Instance permissions assignments to logins and roles.sql."SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004000SQL Server must protect against a user falsely repudiating by ensuring all accounts are individual, unique, and not shared.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. - -In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93833V-79127CCI-000166Remove user-accessible shared accounts and use individual user IDs. - -Build/configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances. - -Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.Obtain the list of authorized SQL Server accounts in the system documentation. - -Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. - -If accounts are determined to be shared, determine if individuals are first individually authenticated. - -If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. - -The key is individual accountability. If this can be traced, this is not a finding. - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. - -Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. - -If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. - -Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004100SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. - -In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. - -Any user with enough access to the server can execute a task that will be run as NT AUTHORITY\SYSTEM either using task scheduler or other tools. At this point, NT AUTHORITY\SYSTEM essentially becomes a shared account because the operating system and SQL Server are unable to determine who created the process. - +If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-003900SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.<VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies. + +Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. + +Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. + +This requirement is applicable to access control enforcement applications, a category that includes database management systems. If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93831V-79125CCI-000213Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them into line with the documented requirements.Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. + +Review the permissions actually in place on the server. + +If the actual permissions do not match the documented requirements, this is a finding. + +Use the supplemental file "Instance permissions assignments to logins and roles.sql."SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004000SQL Server must protect against a user falsely repudiating by ensuring all accounts are individual, unique, and not shared.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93833V-79127CCI-000166Remove user-accessible shared accounts and use individual user IDs. + +Build/configure applications to ensure successful individual authentication prior to shared account access. + +Ensure each user's identity is received and used in audit data in all relevant circumstances. + +Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.Obtain the list of authorized SQL Server accounts in the system documentation. + +Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. + +If accounts are determined to be shared, determine if individuals are first individually authenticated. + +If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. + +The key is individual accountability. If this can be traced, this is not a finding. + +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. + +Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. + +If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. + +Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004100SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. + +Any user with enough access to the server can execute a task that will be run as NT AUTHORITY\SYSTEM either using task scheduler or other tools. At this point, NT AUTHORITY\SYSTEM essentially becomes a shared account because the operating system and SQL Server are unable to determine who created the process. + Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role by default. This allowed jobs/tasks to be executed in SQL Server without the approval or knowledge of the DBA because it looked like operating system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93835V-79129CCI-000166Remove permissions that were identified as not allowed in the check content. USE Master; @@ -284,18 +284,18 @@ REVERT GO - + If IsClustered returns 1, IsHadrEnabled returns 0, and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding. - + If IsHadrEnabled returns 1 and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding. - + If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding. -SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004200SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. - -In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. - +SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004200SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. + If the computer account of a remote computer is granted access to SQL Server, any service or scheduled task running as NT AUTHORITY\SYSTEM or NT AUTHORITY\NETWORK SERVICE can log into the instance and perform actions. These actions cannot be traced back to a specific user or process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93837V-79131CCI-000166Remove all logins that were returned in the check content.Execute the following query: SELECT name @@ -317,2315 +317,1533 @@ Note: <name> represents the username portion of the login. For example, if If no account information is returned, this is not a finding. -If account information is returned, this is a finding.SRG-APP-000089-DB-000064<GroupDescription></GroupDescription>SQL6-D0-004300SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.<VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. +If account information is returned, this is a finding.SRG-APP-000089-DB-000064<GroupDescription></GroupDescription>SQL6-D0-004300SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.<VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +Audit records can be generated from various components within SQL Server (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. + +DoD has defined the list of events for which SQL Server will provide an audit record generation capability as the following: + +(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); + +(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and + +(iii) All account creation, modification, disabling, and termination actions. + +Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93839V-79133CCI-000169Add all required audit events to the STIG Compliant audit specification server documentation.Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. + +Execute the following query to get all of the installed audits: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. + +To view the actions being audited by the audits, execute the following query: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 + +Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding.SRG-APP-000090-DB-000065<GroupDescription></GroupDescription>SQL6-D0-004400SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.<VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. + +Suppression of auditing could permit an adversary to evade detection. + +Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93841V-79135CCI-000171Create a server role specifically for audit maintainers and give it permission to maintain audits without granting it unnecessary permissions (the role name used here is an example; other names may be used): + +CREATE SERVER ROLE SERVER_AUDIT_MAINTAINERS; +GO + +GRANT ALTER ANY SERVER AUDIT TO SERVER_AUDIT_MAINTAINERS; +GO + +Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY SERVER AUDIT permission from all logins. Then, for each authorized login, run the statement: + +ALTER SERVER ROLE SERVER_AUDIT_MAINTAINERS ADD MEMBER; +GO + +Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL SERVER, ALTER ANY DATABASE and CREATE ANY DATABASE permissions from logins that do not need them.Obtain the list of approved audit maintainers from the system documentation. + +Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. + +sysadmin +dbcreator + +Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. + +ALTER ANY SERVER AUDIT +CONTROL SERVER +ALTER ANY DATABASE +CREATE ANY DATABASE + +Use the following query to determine the roles and logins that have the listed permissions: + +SELECT-- DISTINCT + CASE + WHEN SP.class_desc IS NOT NULL THEN + CASE + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' + ELSE SP.class_desc + END + WHEN E.name IS NOT NULL THEN 'ENDPOINT' + WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' + WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' + WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' + ELSE '???' + END AS [Securable Class], + CASE + WHEN E.name IS NOT NULL THEN E.name + WHEN S.name IS NOT NULL THEN S.name + WHEN P.name IS NOT NULL THEN P.name + ELSE '???' + END AS [Securable], + P1.name AS [Grantee], + P1.type_desc AS [Grantee Type], + sp.permission_name AS [Permission], + sp.state_desc AS [State], + P2.name AS [Grantor], + P2.type_desc AS [Grantor Type], +R.name AS [Role Name] +FROM + sys.server_permissions SP + INNER JOIN sys.server_principals P1 + ON P1.principal_id = SP.grantee_principal_id + INNER JOIN sys.server_principals P2 + ON P2.principal_id = SP.grantor_principal_id + + FULL OUTER JOIN sys.servers S + ON SP.class_desc = 'SERVER' + AND S.server_id = SP.major_id + + FULL OUTER JOIN sys.endpoints E + ON SP.class_desc = 'ENDPOINT' + AND E.endpoint_id = SP.major_id + + FULL OUTER JOIN sys.server_principals P + ON SP.class_desc = 'SERVER_PRINCIPAL' + AND P.principal_id = SP.major_id + +FULL OUTER JOIN sys.server_role_members SRM +ON P.principal_id = SRM.member_principal_id + +LEFT OUTER JOIN sys.server_principals R +ON SRM.role_principal_id = R.principal_id +WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') +OR R.name IN ('sysadmin','dbcreator') + +If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.SRG-APP-000091-DB-000066<GroupDescription></GroupDescription>SQL6-D0-004500SQL Server must generate audit records when privileges/permissions are retrieved.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. + +This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93843V-79137CCI-000172If SQL Server is required to audit the retrieval of privilege/permission/role membership information, create a dedicated audit to capture this information. + +USE [master]; +GO + +Set variables needed by setup script: +DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid uniqueidentifier, @auditFileSize varchar(4), @auditFileCount varchar(4) + +Define the name of the audit: +SET @auditName = 'STIG_Audit_Permissions_Queries' + +Define the directory in which audit log files reside: +SET @auditPath = 'C:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audits' + +Define the unique identifier for the audit: +SET @auditGuid = NEWID() + +Define the maximum size for a single audit file (MB): +SET @auditFileSize = 200 + +Define the number of files that should be kept online. Use -1 for unlimited: +SET @auditFileCount = 50 + +Insert the variables into a temp table so they survive for the duration of the script: +CREATE TABLE #SetupVars +( + Variable varchar(50), + Value varchar(260) +) +INSERT INTO #SetupVars (Variable, Value) + VALUES ('auditName', @auditName), + ('auditPath', @auditPath), + ('auditGuid', convert(varchar(40), @auditGuid)), + ('auditFileSize', @auditFileSize), + ('auditFileCount', @auditFileCount) +GO + +Delete the audit if it currently exists: + +Disable the Server Audit Specification: +DECLARE @auditName varchar(50), @disableSpecification nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @disableSpecification = ' +IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') +ALTER SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] WITH (STATE = OFF);' +EXEC(@disableSpecification) +GO + +Drop the Server Audit Specification: +DECLARE @auditName varchar(50), @dropSpecification nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @dropSpecification = ' +IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') +DROP SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION];' +EXEC(@dropSpecification) +GO + +Disable the Server Audit: +DECLARE @auditName varchar(50), @disableAudit nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @disableAudit = ' +IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') +ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = OFF);' +EXEC(@disableAudit) +GO + +Drop the Server Audit: +DECLARE @auditName varchar(50), @dropAudit nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @dropAudit = ' +IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') +DROP SERVER AUDIT [' + @auditName + '];' +EXEC(@dropAudit) +GO + +Set up the SQL Server Audit: + +USE [master]; +GO + +Create the Server Audit: +DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid varchar(40), @auditFileSize varchar(4), @auditFileCount varchar(5) + +SELECT @auditName = Value FROM #SetupVars WHERE Variable = 'auditName' +SELECT @auditPath = Value FROM #SetupVars WHERE Variable = 'auditPath' +SELECT @auditGuid = Value FROM #SetupVars WHERE Variable = 'auditGuid' +SELECT @auditFileSize = Value FROM #SetupVars WHERE Variable = 'auditFileSize' +SELECT @auditFileCount = Value FROM #SetupVars WHERE Variable = 'auditFileCount' + +DECLARE @createStatement nvarchar(max) +SET @createStatement = ' +CREATE SERVER AUDIT [' + @auditName + '] +TO FILE +( + FILEPATH = ''' + @auditPath + ''' + , MAXSIZE = ' + @auditFileSize + ' MB + , MAX_ROLLOVER_FILES = ' + CASE WHEN @auditFileCount = -1 THEN 'UNLIMITED' ELSE @auditFileCount END + ' + , RESERVE_DISK_SPACE = OFF +) +WITH +( + QUEUE_DELAY = 1000 + , ON_FAILURE = SHUTDOWN + , AUDIT_GUID = ''' + @auditGuid + ''' +) +WHERE ([Schema_Name] = ''sys'' AND [Object_Name] = ''all_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_permissions'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_principals'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_role_members'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_column_store_object_pool'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_db_xtp_object_stats'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_os_memory_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_object_columns'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_session_object_columns'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''filetable_system_defined_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''linked_logins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''login_token'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''remote_logins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_permissions'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principal_credentials'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principals'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_role_members'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sql_logins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syscacheobjects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syslogins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysobjects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysoledbusers'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syspermissions'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysremotelogins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''system_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysusers'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''user_token'') +' + +EXEC(@createStatement) +GO + +Turn on the Audit: +DECLARE @auditName varchar(50), @enableAudit nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @enableAudit = ' +IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') +ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = ON);' +EXEC(@enableAudit) +GO + +Create the server audit specifications: +DECLARE @auditName varchar(50), @createSpecification nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @createSpecification = ' +CREATE SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] +FOR SERVER AUDIT [' + @auditName + '] + ADD (SCHEMA_OBJECT_ACCESS_GROUP) +WITH (STATE = ON);' +EXEC(@createSpecification) +GO + +Clean up: +DROP TABLE #SetupVarsReview the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000091-DB-000325<GroupDescription></GroupDescription>SQL6-D0-004600SQL Server must generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. + +This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93845V-79139CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000092-DB-000208<GroupDescription></GroupDescription>SQL6-D0-004700SQL Server must initiate session auditing upon startup.<VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93847V-79141CCI-001464Configure the SQL Audit(s) to automatically start during system start-up. + +ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON + +Execute the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status +WHERE status_desc = 'STARTED' + +Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.When Audits are enabled, they start up when the instance starts. +https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 + +Check if an audit is configured and enabled. + +Execute the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status +WHERE status_desc = 'STARTED' + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.SRG-APP-000101-DB-000044<GroupDescription></GroupDescription>SQL6-D0-005500SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events. + +The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of users of shared accounts, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. + +Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93851V-79145CCI-000135Design and deploy an Audit that captures all auditable events and data items. In the event a third-party tool is used for auditing it must contain all the required information including but not limited to events, type, location, subject, date and time and by whom the change occurred. + +Implement additional custom audits to capture the additional organizational required information.If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. + +Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit. + +If there are none specified, this is not a finding. + +If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements. + +If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.SRG-APP-000109-DB-000049<GroupDescription></GroupDescription>SQL6-D0-005600SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. + +When the need for system availability does not outweigh the need for a complete audit trail, SQL Server should shut down immediately, rolling back all in-flight transactions. + +Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93853V-79147CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs. + +Run this T-SQL script for each identified audit: + +ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF); +GO +ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN); +GO +ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON); +GOIf the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). + +If SQL Server Audit is in use, review the defined server audits by running the statement: + +SELECT * FROM sys.server_audits; + +By observing the [name] and [is_state_enabled] columns, identify the row or rows in use. + +If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.SRG-APP-000109-DB-000321<GroupDescription></GroupDescription>SQL6-D0-005700SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. + +When availability is an overriding concern, approved actions in response to an audit failure are as follows: + +(i) If the failure was caused by the lack of audit record storage capacity, SQL Server must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. + +(ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, SQL Server must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. + +Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93855V-79149CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. + +Run this T-SQL script for each identified audit: + +ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF); +GO +ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue); +GO +ALTER SERVER AUDIT [AuditName] WITH (STATE = ON); +GOIf the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). -Audit records can be generated from various components within SQL Server (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. +Execute the following query: -DoD has defined the list of events for which SQL Server will provide an audit record generation capability as the following: +SELECT a.name 'audit_name', + a.type_desc 'storage_type', + f.max_rollover_files +FROM sys.server_audits a +LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id +WHERE a.is_state_enabled = 1 -(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); +If no records are returned, this is a finding. -(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and +If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG", this is not a finding. -(iii) All account creation, modification, disabling, and termination actions. +If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding. +SRG-APP-000118-DB-000059<GroupDescription></GroupDescription>SQL6-D0-005900The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.<VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. -Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93839V-79133CCI-000169Add all required audit events to the STIG Compliant audit specification server documentation.Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. +To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. -Execute the following query to get all of the installed audits: +This requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections and limiting log data location. -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. SQL Server is an application that is able to view and manipulate audit file data. -All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. +Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. -To view the actions being audited by the audits, execute the following query: +Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93857V-79151CCI-000162CCI-000163CCI-000164Modify audit file permissions to meet the requirement to protect against unauthorized access. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 +Application event log and security log permissions are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use. -Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding.SRG-APP-000090-DB-000065<GroupDescription></GroupDescription>SQL6-D0-004400SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.<VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. +Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file and click "Properties". + +On the Security tab, modify the security permissions to: +Administrator (read) +Users (none) +Audit Administrator(Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] + +----- +Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.130).aspx. + +Note 2: Tips for adding a service SID/virtual account to a folder's permission list. + +1) In Windows Explorer, right-click the folder and select "Properties". +2) Select the "Security" tab. +3) Click "Edit". +4) Click "Add". +5) Click "Locations". +6) Select the computer name. +7) Search for the name. +7.a) SQL Server Service +7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) +7.a.ii) Select the "MSSQL$" user and click "OK". +7.b) SQL Agent Service +7.b.i) Type "NT SERVICE\SQL" and click "Check Names". +7.b.ii) Select the "SQLAgent$" user and click "OK". +8) Click "OK". +9) Permission like a normal user from here.If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A. -Suppression of auditing could permit an adversary to evade detection. +Obtain the SQL Server audit file location(s) by running the following SQL script: + +SELECT log_file_path AS "Audit Path" +FROM sys.server_file_audits + +For each audit, the path column will give the location of the file. + +Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. + +Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: + +Administrator (read) +Users (none) +Audit Administrator (Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.SRG-APP-000121-DB-000202<GroupDescription></GroupDescription>SQL6-D0-006200SQL Server must protect its audit features from unauthorized access.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. + +Depending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. It is, therefore, imperative that access to audit tools be controlled and protected from unauthorized access. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, OS-provided audit tools, vendor-provided audit tools, and open source audit tools needed to successfully view and manipulate audit information system activity and records. + +If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93863V-79157CCI-001493Remove audit-related permissions from individuals and roles not authorized to have them. + +USE master; +DENY [ALTER ANY SERVER AUDIT] TO [User]; +GOCheck the server documentation for a list of approved users with access to SQL Server Audits. + +To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. To view an Audit log requires the CONTROL SERVER permission. To use Profiler, ALTER TRACE is required. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER, ALTER TRACE: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding.SRG-APP-000122-DB-000203<GroupDescription></GroupDescription>SQL6-D0-006300SQL Server must protect its audit configuration from unauthorized modification.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93865V-79159CCI-001494Remove audit-related permissions from individuals and roles not authorized to have them. + +USE master; +DENY [ALTER ANY SERVER AUDIT] TO [User]; +GOCheck the server documentation for a list of approved users with access to SQL Server Audits. + +To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding.SRG-APP-000123-DB-000204<GroupDescription></GroupDescription>SQL6-D0-006400SQL Server must protect its audit features from unauthorized removal.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93867V-79161CCI-001495Remove audit-related permissions from individuals and roles not authorized to have them. + +USE master; +DENY [ALTER ANY SERVER AUDIT] TO [User]; +GOCheck the server documentation for a list of approved users with access to SQL Server Audits. + +To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006500SQL Server must limit privileges to change software modules and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. + +Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93869V-79163CCI-001499Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. + +If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. + +To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. + +Navigate to the folder above, and review the "Binn" subdirectory.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006600SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. + +Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79165SV-93871CCI-001499Implement and document a process by which changes made to software libraries are monitored and alerted. -Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93841V-79135CCI-000171Create a server role specifically for audit maintainers and give it permission to maintain audits without granting it unnecessary permissions (the role name used here is an example; other names may be used): +A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files. -CREATE SERVER ROLE SERVER_AUDIT_MAINTAINERS; -GO +Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file. -GRANT ALTER ANY SERVER AUDIT TO SERVER_AUDIT_MAINTAINERS; -GO +Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. -Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY SERVER AUDIT permission from all logins. Then, for each authorized login, run the statement: +If alerts do not at least hash their value, this is a finding. -ALTER SERVER ROLE SERVER_AUDIT_MAINTAINERS ADD MEMBER; -GO +To determine the location for these instance-specific binaries: -Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL SERVER, ALTER ANY DATABASE and CREATE ANY DATABASE permissions from logins that do not need them.Obtain the list of approved audit maintainers from the system documentation. - -Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. - -sysadmin -dbcreator - -Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. - -ALTER ANY SERVER AUDIT -CONTROL SERVER -ALTER ANY DATABASE -CREATE ANY DATABASE - -Use the following query to determine the roles and logins that have the listed permissions: - -SELECT-- DISTINCT - CASE - WHEN SP.class_desc IS NOT NULL THEN - CASE - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' - ELSE SP.class_desc - END - WHEN E.name IS NOT NULL THEN 'ENDPOINT' - WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' - WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' - WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' - ELSE '???' - END AS [Securable Class], - CASE - WHEN E.name IS NOT NULL THEN E.name - WHEN S.name IS NOT NULL THEN S.name - WHEN P.name IS NOT NULL THEN P.name - ELSE '???' - END AS [Securable], - P1.name AS [Grantee], - P1.type_desc AS [Grantee Type], - sp.permission_name AS [Permission], - sp.state_desc AS [State], - P2.name AS [Grantor], - P2.type_desc AS [Grantor Type], -R.name AS [Role Name] -FROM - sys.server_permissions SP - INNER JOIN sys.server_principals P1 - ON P1.principal_id = SP.grantee_principal_id - INNER JOIN sys.server_principals P2 - ON P2.principal_id = SP.grantor_principal_id - - FULL OUTER JOIN sys.servers S - ON SP.class_desc = 'SERVER' - AND S.server_id = SP.major_id - - FULL OUTER JOIN sys.endpoints E - ON SP.class_desc = 'ENDPOINT' - AND E.endpoint_id = SP.major_id - - FULL OUTER JOIN sys.server_principals P - ON SP.class_desc = 'SERVER_PRINCIPAL' - AND P.principal_id = SP.major_id - -FULL OUTER JOIN sys.server_role_members SRM -ON P.principal_id = SRM.member_principal_id - -LEFT OUTER JOIN sys.server_principals R -ON SRM.role_principal_id = R.principal_id -WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') -OR R.name IN ('sysadmin','dbcreator') - -If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.SRG-APP-000091-DB-000066<GroupDescription></GroupDescription>SQL6-D0-004500SQL Server must generate audit records when privileges/permissions are retrieved.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. - -This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93843V-79137CCI-000172If SQL Server is required to audit the retrieval of privilege/permission/role membership information, create a dedicated audit to capture this information. - -USE [master]; -GO +Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property -Set variables needed by setup script: -DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid uniqueidentifier, @auditFileSize varchar(4), @auditFileCount varchar(4) +TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.SRG-APP-000133-DB-000198<GroupDescription></GroupDescription>SQL6-D0-006700SQL Server software installation account must be restricted to authorized users.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects on the overall security of the system. + +If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed access to information system components for purposes of initiating changes, including upgrades and modifications. + +DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93873V-79167CCI-001499From a command prompt, open lusrmgr.msc. Navigate to Users >> right-click Individual User >> Properties >> Member Of. + +Configure SQL Server and OS settings and access controls to restrict user access to objects and data that the user is authorized to view/use.From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. + +sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" +Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " + +If any accounts are shown that are not authorized in the system documentation, this is a finding.SRG-APP-000133-DB-000199<GroupDescription></GroupDescription>SQL6-D0-006800Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. + +Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93875V-79169CCI-001499Re-install SQL Server application components using dedicated directories that are separate from the operating system. + +Relocate or reinstall other application software that currently shares directories with SQL Server components. + +Separate from the operating system and/or temporary storage.Determine the directory in which SQL Server has been installed: -Define the name of the audit: -SET @auditName = 'STIG_Audit_Permissions_Queries' +Using SQL Server Management Studio's Object Explorer: +- Right-click [SQL Server Instance] +- Select "Facets" +- Record the value of RootDirectory -Define the directory in which audit log files reside: -SET @auditPath = 'C:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audits' +Determine the Operating System directory: +- Click "Start" +- Type "Run" +- Press "Enter" +- Type "%windir%" +- Click "Ok" +- Record the value in the address bar -Define the unique identifier for the audit: -SET @auditGuid = NEWID() +Verify the SQL Server RootDirectory is not in the Operating System directory. -Define the maximum size for a single audit file (MB): -SET @auditFileSize = 200 +Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding. -Define the number of files that should be kept online. Use -1 for unlimited: -SET @auditFileCount = 50 +Verify the SQL Server RootDirectory is not in another application's directory. -Insert the variables into a temp table so they survive for the duration of the script: -CREATE TABLE #SetupVars -( - Variable varchar(50), - Value varchar(260) -) -INSERT INTO #SetupVars (Variable, Value) - VALUES ('auditName', @auditName), - ('auditPath', @auditPath), - ('auditGuid', convert(varchar(40), @auditGuid)), - ('auditFileSize', @auditFileSize), - ('auditFileCount', @auditFileCount) -GO +Navigate to the SQL RootDirectory using Windows Explorer. -Delete the audit if it currently exists: +Examine each directory for evidence another application is stored in it. -Disable the Server Audit Specification: -DECLARE @auditName varchar(50), @disableSpecification nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @disableSpecification = ' -IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') -ALTER SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] WITH (STATE = OFF);' -EXEC(@disableSpecification) -GO +If evidence exists the SQL RootDirectory is in another application's directory, this is a finding. -Drop the Server Audit Specification: -DECLARE @auditName varchar(50), @dropSpecification nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @dropSpecification = ' -IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') -DROP SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION];' -EXEC(@dropSpecification) -GO +If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding. -Disable the Server Audit: -DECLARE @auditName varchar(50), @disableAudit nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @disableAudit = ' -IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') -ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = OFF);' -EXEC(@disableAudit) -GO +Examples: +1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding. -Drop the Server Audit: -DECLARE @auditName varchar(50), @dropAudit nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @dropAudit = ' -IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') -DROP SERVER AUDIT [' + @auditName + '];' -EXEC(@dropAudit) -GO +2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding. -Set up the SQL Server Audit: +3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.SRG-APP-000141-DB-000090<GroupDescription></GroupDescription>SQL6-D0-006900Default demonstration and sample databases, database objects, and applications must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality, not required for every mission, that cannot be disabled. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities. + +Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93877V-79171CCI-000381Remove all demonstration or sample databases from production instances.Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. + +If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: + +pubs +Northwind +AdventureWorks +WorldwideImporters + +If any of these databases exist, this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL6-D0-007000Unused database components, DBMS software, and database objects must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93879V-79173CCI-000381Remove all features that are not required.From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. + +If any features are installed, but are not required, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-007100Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities. + +Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93881V-79175CCI-000381Disable any unused components or features that cannot be uninstalled.From the server documentation, obtain a listing of required components. -USE [master]; -GO +Generate a listing of components installed on the server. -Create the Server Audit: -DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid varchar(40), @auditFileSize varchar(4), @auditFileCount varchar(5) +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" -SELECT @auditName = Value FROM #SetupVars WHERE Variable = 'auditName' -SELECT @auditPath = Value FROM #SetupVars WHERE Variable = 'auditPath' -SELECT @auditGuid = Value FROM #SetupVars WHERE Variable = 'auditGuid' -SELECT @auditFileSize = Value FROM #SetupVars WHERE Variable = 'auditFileSize' -SELECT @auditFileCount = Value FROM #SetupVars WHERE Variable = 'auditFileCount' +Compare the feature listing against the required components listing. Note any components that are installed, but not required. -DECLARE @createStatement nvarchar(max) -SET @createStatement = ' -CREATE SERVER AUDIT [' + @auditName + '] -TO FILE -( - FILEPATH = ''' + @auditPath + ''' - , MAXSIZE = ' + @auditFileSize + ' MB - , MAX_ROLLOVER_FILES = ' + CASE WHEN @auditFileCount = -1 THEN 'UNLIMITED' ELSE @auditFileCount END + ' - , RESERVE_DISK_SPACE = OFF -) -WITH -( - QUEUE_DELAY = 1000 - , ON_FAILURE = SHUTDOWN - , AUDIT_GUID = ''' + @auditGuid + ''' -) -WHERE ([Schema_Name] = ''sys'' AND [Object_Name] = ''all_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_permissions'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_principals'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_role_members'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_column_store_object_pool'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_db_xtp_object_stats'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_os_memory_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_object_columns'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_session_object_columns'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''filetable_system_defined_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''linked_logins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''login_token'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''remote_logins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_permissions'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principal_credentials'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principals'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_role_members'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sql_logins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syscacheobjects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syslogins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysobjects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysoledbusers'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syspermissions'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysremotelogins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''system_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysusers'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''user_token'') -' - -EXEC(@createStatement) -GO +Launch SQL Server Configuration Manager. -Turn on the Audit: -DECLARE @auditName varchar(50), @enableAudit nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @enableAudit = ' -IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') -ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = ON);' -EXEC(@enableAudit) -GO +If any components that are installed but are not required are not disabled, this is a finding. -Create the server audit specifications: -DECLARE @auditName varchar(50), @createSpecification nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @createSpecification = ' -CREATE SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] -FOR SERVER AUDIT [' + @auditName + '] - ADD (SCHEMA_OBJECT_ACCESS_GROUP) -WITH (STATE = ON);' -EXEC(@createSpecification) -GO +If any required components are not installed, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007200Access to xp_cmdshell must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93883V-79177CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. -Clean up: -DROP TABLE #SetupVarsReview the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. +To disable the use of xp_cmdshell, from the query prompt:  -If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. +EXEC sp_configure 'show advanced options', 1;  +GO  +RECONFIGURE;  +GO  +EXEC sp_configure 'xp_cmdshell', 0;  +GO  +RECONFIGURE;  +GO??The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. + +To determine if xp_cmdshell is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'xp_cmdshell'; + +If the value of "config_value" is "0", this is not a finding. + +Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007300Access to CLR code must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93885V-79179CCI-000381Disable use of or remove any CLR code that is not authorized. + +To disable the use of CLR, from the query prompt: + +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'clr enabled', 0; +GO +RECONFIGURE; +GO + +For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. + +To determine if CLR is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'clr enabled'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. + +If CLR code is approved, check the database for UNSAFE assembly permission using the following script: -If the documentation does not exist, this is a finding. +USE [master] +SELECT * +FROM sys.assemblies +WHERE permission_set_desc != 'SAFE' +AND is_user_defined = 1; -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. +If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007400Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93887V-79181CCI-000381Remove any Non-Standard extended stored procedures that are not documented and approved. + +sp_dropextendedproc 'proc name'Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. + +Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible. + +To determine if non-standard extended stored procedures exist, run the following: -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +------------------------------------------------------------------------ +USE [master] +GO +DECLARE @xplist AS TABLE +( + xp_name sysname, + source_dll nvarchar(255) +) +INSERT INTO @xplist +EXEC sp_helpextendedproc -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification: +SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name +------------------------------------------------------------------------ + +If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007500Access to linked servers must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93889V-79183CCI-000381Disable use of or remove any linked servers that are not authorized. + +To remove a linked server and all associated logins run the following: + +sp_dropserver 'LinkedServerName', 'droplogins'; + +To remove a login from a linked server run the following: + +EXEC sp_droplinkedsrvlogin 'LoginName', NULL;A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. + +To obtain a list of linked servers, execute the following command: + +EXEC sp_linkedservers; + +Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. + +Run the following to get a linked server login mapping: + +SELECT s.name, p.principal_id, l.remote_name +FROM sys.servers s +JOIN sys.linked_logins l ON s.server_id = l.server_id +LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id +WHERE s.is_linked = 1 + +Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007600SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary protocols on information systems. + +Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. + +To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of protocols to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. + +SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93891V-79185CCI-000382In SQL Server Configuration Manager >> SQL Server Network Configuration >> Protocols, right-click on each listed protocol that is enabled but not authorized and Select "Disable".To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. + +If Named Pipes is enabled and not specifically required and authorized, this is a finding. + +If any listed protocol is enabled but not authorized, this is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007700SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports on information systems. + +Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. + +To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. + +SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93893V-79187CCI-000382Use SQL Server Configuration to change the ports used by SQL Server to comply with PPSM guidance, or document the need for other ports, and obtain written approval. Close ports no longer needed.Review SQL Server Configuration for the ports used by SQL Server. + +To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) + +If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding.SRG-APP-000148-DB-000103<GroupDescription></GroupDescription>SQL6-D0-007800SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).<VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. + +Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: + +(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and +(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93895V-79189CCI-000764Remove user-accessible shared accounts and use individual userIDs. + +Configure applications to ensure successful individual authentication prior to shared account access. + +Ensure each user's identity is received and used in audit data in all relevant circumstances.Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) + +If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. + +If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. + +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-007900If DBMS authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity and lifetime.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. + +The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93897V-79191CCI-000192Configure the SQL Server operating system and SQL Server logins for compliance. + +1. Ensure the password complexity requirements for the corresponding DISA Windows Server Security Technical Implementation Guide are met on the server where the SQL Server Instance is installed. + +2. Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created. -If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000091-DB-000325<GroupDescription></GroupDescription>SQL6-D0-004600SQL Server must generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. +CREATE LOGIN <login_name> WITH PASSWORD= <enterStrongPasswordHere>, CHECK_EXPIRATION = ON, CHECK_POLICY = ON; +Check for use of SQL Server Authentication: -This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted. +SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode] -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93845V-79139CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. +If the returned value in the “[Authentication Mode]” column is “Windows Authentication”, this is not a finding. -If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. +SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system. -If the documentation does not exist, this is a finding. +Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement: -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. +SELECT [name], is_expiration_checked, is_policy_checked +FROM sys.sql_logins -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, and ##MS_PolicyEventProcessingLogin##. -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. +If any account doesn't have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +Review the Operating System settings relating to password complexity. -If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000092-DB-000208<GroupDescription></GroupDescription>SQL6-D0-004700SQL Server must initiate session auditing upon startup.<VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93847V-79141CCI-001464Configure the SQL Audit(s) to automatically start during system start-up. +Determine whether the following rules are enforced. If any are not, this is a finding. -ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON +Check the server operating system for password complexity: -Execute the following query: +Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy and to review the local policies on the machine. Account Policy >> Password Policy: -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status -WHERE status_desc = 'STARTED' +Ensure the DISA Windows Password Policy is set on the SQL Server member server.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-008000Contained databases must use Windows principals.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. + +The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93899V-79193CCI-000192Configure the SQL Server contained databases to have users originating from Windows principals. Remove any users not created from Windows principals.Execute the following query to determine if Contained Databases are used: + +SELECT * FROM sys.databases WHERE containment = 1 + +If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. + +EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' + +If any records are returned, this is a finding.SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008200If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. + +Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. + +SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93901V-79195CCI-000197Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography. -Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.When Audits are enabled, they start up when the instance starts. -https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 +Deploy encryption to the SQL Server Network Connections. -Check if an audit is configured and enabled. +From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". -Execute the following query: +Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status -WHERE status_desc = 'STARTED' +In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service. -All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.SRG-APP-000101-DB-000044<GroupDescription></GroupDescription>SQL6-D0-005500SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events. +For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger. -The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of users of shared accounts, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. +1. Navigate to the certificate store where the FQDN certificate is stored, by typing "certlm.msc" and pressing "ENTER". -Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93851V-79145CCI-000135Design and deploy an Audit that captures all auditable events and data items. In the event a third-party tool is used for auditing it must contain all the required information including but not limited to events, type, location, subject, date and time and by whom the change occurred. +2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window. -Implement additional custom audits to capture the additional organizational required information.If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. +3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad. -Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit. +4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate -If there are none specified, this is not a finding. +5. If the SQL virtual server is currently on this node, failover to another node in your cluster, and then reboot the node where the registry change occurred. -If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements. +6. Repeat this procedure on all the nodes. +From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". -If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.SRG-APP-000109-DB-000049<GroupDescription></GroupDescription>SQL6-D0-005600SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. +Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on “Properties”. -When the need for system availability does not outweigh the need for a complete audit trail, SQL Server should shut down immediately, rolling back all in-flight transactions. +On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. -Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93853V-79147CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs. +On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. -Run this T-SQL script for each identified audit: +If it is not a DoD certificate, or if no certificate is listed, this is a finding. -ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF); -GO -ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN); -GO -ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON); -GOIf the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). +For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. -If SQL Server Audit is in use, review the defined server audits by running the statement: +1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER". -SELECT * FROM sys.server_audits; +2. In the left side of the window, expand the "Personal" folder, and click "Certificates" -By observing the [name] and [is_state_enabled] columns, identify the row or rows in use. +3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint. -If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.SRG-APP-000109-DB-000321<GroupDescription></GroupDescription>SQL6-D0-005700SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. - -When availability is an overriding concern, approved actions in response to an audit failure are as follows: - -(i) If the failure was caused by the lack of audit record storage capacity, SQL Server must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. - -(ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, SQL Server must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. - -Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93855V-79149CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. - -Run this T-SQL script for each identified audit: - -ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF); -GO -ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue); -GO -ALTER SERVER AUDIT [AuditName] WITH (STATE = ON); -GOIf the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). - -Execute the following query: - -SELECT a.name 'audit_name', - a.type_desc 'storage_type', - f.max_rollover_files -FROM sys.server_audits a -LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id -WHERE a.is_state_enabled = 1 - -If no records are returned, this is a finding. - -If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG", this is not a finding. - -If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding. -SRG-APP-000118-DB-000059<GroupDescription></GroupDescription>SQL6-D0-005900The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.<VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. - -To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. - -This requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections and limiting log data location. - -Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. SQL Server is an application that is able to view and manipulate audit file data. - -Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. - -Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93857V-79151CCI-000162CCI-000163CCI-000164Modify audit file permissions to meet the requirement to protect against unauthorized access. - -Application event log and security log permissions are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use. - -Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file and click "Properties". - -On the Security tab, modify the security permissions to: -Administrator (read) -Users (none) -Audit Administrator(Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - ------ -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.130).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. - -1) In Windows Explorer, right-click the folder and select "Properties". -2) Select the "Security" tab. -3) Click "Edit". -4) Click "Add". -5) Click "Locations". -6) Select the computer name. -7) Search for the name. -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$" user and click "OK". -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names". -7.b.ii) Select the "SQLAgent$" user and click "OK". -8) Click "OK". -9) Permission like a normal user from here.If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A. - -Obtain the SQL Server audit file location(s) by running the following SQL script: - -SELECT log_file_path AS "Audit Path" -FROM sys.server_file_audits - -For each audit, the path column will give the location of the file. - -Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. - -Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: - -Administrator (read) -Users (none) -Audit Administrator (Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.SRG-APP-000121-DB-000202<GroupDescription></GroupDescription>SQL6-D0-006200SQL Server must protect its audit features from unauthorized access.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. - -Depending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. It is, therefore, imperative that access to audit tools be controlled and protected from unauthorized access. - -Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools. SQL Server is an application that does provide access to audit data. - -Audit tools include, but are not limited to, OS-provided audit tools, vendor-provided audit tools, and open source audit tools needed to successfully view and manipulate audit information system activity and records. - -If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93863V-79157CCI-001493Remove audit-related permissions from individuals and roles not authorized to have them. - -USE master; -DENY [ALTER ANY SERVER AUDIT] TO [User]; -GOCheck the server documentation for a list of approved users with access to SQL Server Audits. - -To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. To view an Audit log requires the CONTROL SERVER permission. To use Profiler, ALTER TRACE is required. - -Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER, ALTER TRACE: - -SELECT login.name, perm.permission_name, perm.state_desc -FROM sys.server_permissions perm -JOIN sys.server_principals login -ON perm.grantee_principal_id = login.principal_id -WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE') -and login.name not like '##MS_%'; - -If unauthorized accounts have these privileges, this is a finding.SRG-APP-000122-DB-000203<GroupDescription></GroupDescription>SQL6-D0-006300SQL Server must protect its audit configuration from unauthorized modification.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. - -Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. SQL Server is an application that does provide access to audit data. - -Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93865V-79159CCI-001494Remove audit-related permissions from individuals and roles not authorized to have them. - -USE master; -DENY [ALTER ANY SERVER AUDIT] TO [User]; -GOCheck the server documentation for a list of approved users with access to SQL Server Audits. - -To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. - -Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT: - -SELECT login.name, perm.permission_name, perm.state_desc -FROM sys.server_permissions perm -JOIN sys.server_principals login -ON perm.grantee_principal_id = login.principal_id -WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') -and login.name not like '##MS_%'; - -If unauthorized accounts have these privileges, this is a finding.SRG-APP-000123-DB-000204<GroupDescription></GroupDescription>SQL6-D0-006400SQL Server must protect its audit features from unauthorized removal.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. - -Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit tools. SQL Server is an application that does provide access to audit data. - -Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93867V-79161CCI-001495Remove audit-related permissions from individuals and roles not authorized to have them. - -USE master; -DENY [ALTER ANY SERVER AUDIT] TO [User]; -GOCheck the server documentation for a list of approved users with access to SQL Server Audits. - -To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. - -Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: - -SELECT login.name, perm.permission_name, perm.state_desc -FROM sys.server_permissions perm -JOIN sys.server_principals login -ON perm.grantee_principal_id = login.principal_id -WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') -and login.name not like '##MS_%'; - -If unauthorized accounts have these privileges, this is a finding.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006500SQL Server must limit privileges to change software modules and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. - -Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93869V-79163CCI-001499Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. - -If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. - -To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. - -Navigate to the folder above, and review the "Binn" subdirectory.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006600SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. - -Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79165SV-93871CCI-001499Implement and document a process by which changes made to software libraries are monitored and alerted. - -A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files. - -Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file. - -Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. - -If alerts do not at least hash their value, this is a finding. - -To determine the location for these instance-specific binaries: - -Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property - -TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.SRG-APP-000133-DB-000198<GroupDescription></GroupDescription>SQL6-D0-006700SQL Server software installation account must be restricted to authorized users.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects on the overall security of the system. - -If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed access to information system components for purposes of initiating changes, including upgrades and modifications. - -DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93873V-79167CCI-001499From a command prompt, open lusrmgr.msc. Navigate to Users >> right-click Individual User >> Properties >> Member Of. - -Configure SQL Server and OS settings and access controls to restrict user access to objects and data that the user is authorized to view/use.From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. - -sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" -Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " - -If any accounts are shown that are not authorized in the system documentation, this is a finding.SRG-APP-000133-DB-000199<GroupDescription></GroupDescription>SQL6-D0-006800Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93875V-79169CCI-001499Re-install SQL Server application components using dedicated directories that are separate from the operating system. - -Relocate or reinstall other application software that currently shares directories with SQL Server components. - -Separate from the operating system and/or temporary storage.Determine the directory in which SQL Server has been installed: - -Using SQL Server Management Studio's Object Explorer: -- Right-click [SQL Server Instance] -- Select "Facets" -- Record the value of RootDirectory - -Determine the Operating System directory: -- Click "Start" -- Type "Run" -- Press "Enter" -- Type "%windir%" -- Click "Ok" -- Record the value in the address bar - -Verify the SQL Server RootDirectory is not in the Operating System directory. - -Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding. - -Verify the SQL Server RootDirectory is not in another application's directory. - -Navigate to the SQL RootDirectory using Windows Explorer. - -Examine each directory for evidence another application is stored in it. - -If evidence exists the SQL RootDirectory is in another application's directory, this is a finding. - -If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding. - -Examples: -1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding. - -2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding. - -3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.SRG-APP-000141-DB-000090<GroupDescription></GroupDescription>SQL6-D0-006900Default demonstration and sample databases, database objects, and applications must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality, not required for every mission, that cannot be disabled. - -DBMSs must adhere to the principles of least functionality by providing only essential capabilities. - -Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93877V-79171CCI-000381Remove all demonstration or sample databases from production instances.Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. - -If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: - -pubs -Northwind -AdventureWorks -WorldwideImporters - -If any of these databases exist, this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL6-D0-007000Unused database components, DBMS software, and database objects must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. - -DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93879V-79173CCI-000381Remove all features that are not required.From the server documentation, obtain a listing of required components. - -Generate a listing of components installed on the server. - -Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" - -Compare the feature listing against the required components listing. - -If any features are installed, but are not required, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-007100Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. - -DBMSs must adhere to the principles of least functionality by providing only essential capabilities. - -Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93881V-79175CCI-000381Disable any unused components or features that cannot be uninstalled.From the server documentation, obtain a listing of required components. - -Generate a listing of components installed on the server. - -Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" - -Compare the feature listing against the required components listing. Note any components that are installed, but not required. - -Launch SQL Server Configuration Manager. - -If any components that are installed but are not required are not disabled, this is a finding. - -If any required components are not installed, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007200Access to xp_cmdshell must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93883V-79177CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. - -To disable the use of xp_cmdshell, from the query prompt:  - -EXEC sp_configure 'show advanced options', 1;  -GO  -RECONFIGURE;  -GO  -EXEC sp_configure 'xp_cmdshell', 0;  -GO  -RECONFIGURE;  -GO??The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. - -To determine if xp_cmdshell is enabled, execute the following commands: - -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'xp_cmdshell'; - -If the value of "config_value" is "0", this is not a finding. - -Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007300Access to CLR code must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93885V-79179CCI-000381Disable use of or remove any CLR code that is not authorized. - -To disable the use of CLR, from the query prompt: - -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'clr enabled', 0; -GO -RECONFIGURE; -GO - -For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. - -To determine if CLR is enabled, execute the following commands: - -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'clr enabled'; - -If the value of "config_value" is "0", this is not a finding. - -If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. - -If CLR code is approved, check the database for UNSAFE assembly permission using the following script: - -USE [master] -SELECT * -FROM sys.assemblies -WHERE permission_set_desc != 'SAFE' -AND is_user_defined = 1; - -If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007400Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93887V-79181CCI-000381Remove any Non-Standard extended stored procedures that are not documented and approved. - -sp_dropextendedproc 'proc name'Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. - -Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible. - -To determine if non-standard extended stored procedures exist, run the following: - ------------------------------------------------------------------------- -USE [master] -GO -DECLARE @xplist AS TABLE -( - xp_name sysname, - source_dll nvarchar(255) -) -INSERT INTO @xplist -EXEC sp_helpextendedproc - -SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name ------------------------------------------------------------------------- - -If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved. - -If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007500Access to linked servers must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93889V-79183CCI-000381Disable use of or remove any linked servers that are not authorized. - -To remove a linked server and all associated logins run the following: - -sp_dropserver 'LinkedServerName', 'droplogins'; - -To remove a login from a linked server run the following: - -EXEC sp_droplinkedsrvlogin 'LoginName', NULL;A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. - -To obtain a list of linked servers, execute the following command: - -EXEC sp_linkedservers; - -Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. - -Run the following to get a linked server login mapping: - -SELECT s.name, p.principal_id, l.remote_name -FROM sys.servers s -JOIN sys.linked_logins l ON s.server_id = l.server_id -LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id -WHERE s.is_linked = 1 - -Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007600SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary protocols on information systems. - -Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. - -To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of protocols to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. - -SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93891V-79185CCI-000382In SQL Server Configuration Manager >> SQL Server Network Configuration >> Protocols, right-click on each listed protocol that is enabled but not authorized and Select "Disable".To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. - -If Named Pipes is enabled and not specifically required and authorized, this is a finding. - -If any listed protocol is enabled but not authorized, this is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007700SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports on information systems. - -Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. - -To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. - -SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93893V-79187CCI-000382Use SQL Server Configuration to change the ports used by SQL Server to comply with PPSM guidance, or document the need for other ports, and obtain written approval. Close ports no longer needed.Review SQL Server Configuration for the ports used by SQL Server. - -To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) - -If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding.SRG-APP-000148-DB-000103<GroupDescription></GroupDescription>SQL6-D0-007800SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).<VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. - -Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: - -(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and -(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93895V-79189CCI-000764Remove user-accessible shared accounts and use individual userIDs. - -Configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances.Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) - -If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. - -If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-007900If DBMS authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity and lifetime.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. - -The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93897V-79191CCI-000192Configure the SQL Server operating system and SQL Server logins for compliance. - -1. Ensure the password complexity requirements for the corresponding DISA Windows Server Security Technical Implementation Guide are met on the server where the SQL Server Instance is installed. - -2. Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created. - -CREATE LOGIN <login_name> WITH PASSWORD= <enterStrongPasswordHere>, CHECK_EXPIRATION = ON, CHECK_POLICY = ON; -Check for use of SQL Server Authentication: - -SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode] - -If the returned value in the “[Authentication Mode]” column is “Windows Authentication”, this is not a finding. - -SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system. - -Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement: - -SELECT [name], is_expiration_checked, is_policy_checked -FROM sys.sql_logins - -Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, and ##MS_PolicyEventProcessingLogin##. - -If any account doesn't have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding. - -Review the Operating System settings relating to password complexity. - -Determine whether the following rules are enforced. If any are not, this is a finding. - -Check the server operating system for password complexity: - -Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy and to review the local policies on the machine. Account Policy >> Password Policy: - -Ensure the DISA Windows Password Policy is set on the SQL Server member server.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-008000Contained databases must use Windows principals.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. - -The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93899V-79193CCI-000192Configure the SQL Server contained databases to have users originating from Windows principals. Remove any users not created from Windows principals.Execute the following query to determine if Contained Databases are used: - -SELECT * FROM sys.databases WHERE containment = 1 - -If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. - -EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' - -If any records are returned, this is a finding.SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008200If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. - -Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. - -SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93901V-79195CCI-000197Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography. - -Deploy encryption to the SQL Server Network Connections. - -From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". - -Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". - -In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service. - -For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger. - -1. Navigate to the certificate store where the FQDN certificate is stored, by typing "certlm.msc" and pressing "ENTER". - -2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window. - -3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad. - -4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate - -5. If the SQL virtual server is currently on this node, failover to another node in your cluster, and then reboot the node where the registry change occurred. - -6. Repeat this procedure on all the nodes. -From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". - -Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on “Properties”. - -On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. - -On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. - -If it is not a DoD certificate, or if no certificate is listed, this is a finding. - -For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. - -1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER". - -2. In the left side of the window, expand the "Personal" folder, and click "Certificates" - -3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint. - -4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". - -5. This check needs to be run on each node of the cluster. - -If any nodes have a certificate in use by SQL that is not issued by DOD, this is a finding. -SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008300Confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. - -References: -TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 -TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-106625V-97521CCI-000197 -Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure you have a recent backup of the system and registry settings. - -Access the SQL Server -Access an administrator command prompt -Type "regedit" to launch the Registry Editor - -Enable TLS 1.2: - -1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols - a.If the "TLS 1.2" key does not exist, right-click "Protocols" - b.Click New - c.Click Key - d.Type the name "TLS 1.2" - -2.Navigate to the "TLS 1.2" subkey - a.If the subkey "Client" does not exist, right-click "TLS 1.2" - b.Click New - c.Click Key - d.Type the name "Client" - e.Repeat steps A – D for the "Server" subkey - -3.Navigate to the "Client" subkey - a.If the value "Enabled" does not exist, right-click on "Client" - b.Click New - c.Click DWORD - d.Enter "Enabled" as the name - e.Repeat steps A-D for the value "DisabledByDefault" - -4.Double-click "Enabled" - -5.In Value Data, enter "1" - -6.Click OK - -7.Double-click "DisabledByDefault" - -8.In Value Data, enter "0" - -9.Click OK - -10.Repeat steps 3 – 9 for the "Server" subkey - - -Disable unwanted SSL/TLS protocol versions: - -1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols - a.If the "TLS 1.0" key does not exist, right-click "Protocols" - b.Click New - c.Click Key - d.Type the name "TLS 1.0" - -2.Navigate to the "TLS 1.0" subkey - a.If the subkey "Client" does not exist, right-click "TLS 1.0" - b.Click New - c.Click Key - d.Type the name "Client" - e.Repeat steps A – D for the "Server" subkey - -3.Navigate to the "Client" subkey - a.If the value "Enabled" does not exist, right-click on "Client" - b.Click New - c.Click DWORD - d.Enter "Enabled" as the name - e.Repeat steps A-D for the value "DisabledByDefault" - -4.Double-click "Enabled" - -5.In Value Data, enter "0" - -6.Click OK - -7.Double-click "DisabledByDefault" - -8.In Value Data, enter "1" - -9.Click OK - -10.Repeat steps 3 – 9 for the "Server" subkey - -11.Repeat steps 1 – 10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0" - -Access the SQL Server -Access an administrator command prompt -Type "regedit" to launch the Registry Editor - -Navigate to: -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 - -If this key does not exist, this is a Finding. - -Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. - -Navigate to: -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 - -Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys - -If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. -SRG-APP-000176-DB-000068<GroupDescription></GroupDescription>SQL6-D0-008400SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. - -If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where SQL Server-stored private keys are used to authenticate SQL Server to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against SQL Server system and its clients. - -Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. - -All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93903V-79197CCI-000186Enable use of FIPS 140-2 compliant algorithms. - -Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options - -Double-click "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing." - -Click Enabled >> Apply.Review system configuration to determine whether FIPS 140-2 support has been enabled. - -Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options - -Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. - -If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. - -For more information, see https://support.microsoft.com/en-us/kb/3141890.SRG-APP-000179-DB-000114<GroupDescription></GroupDescription>SQL6-D0-008700SQL Server must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.<VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of SQL Server. - -Applications, including DBMSs, utilizing cryptography are required to use approved NIST FIPS 140-2 validated cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. - -The security functions validated as part of FIPS 140-2 for cryptographic modules are described in FIPS 140-2 Annex A. - -NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93905V-79199CCI-000803In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -In the dialog box that appears, if the radio buttons are active, click "Enabled", and then click "Apply". If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -If, in the "Security Setting" column, the value is "Disabled," this is a finding. - -https://support.microsoft.com/en-us/kb/955720SRG-APP-000180-DB-000115<GroupDescription></GroupDescription>SQL6-D0-008800SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).<VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). - -Non-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. - -Accordingly, a risk assessment is used in determining the authentication needs of the organization. - -Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93907V-79201CCI-000804Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. - -Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: - -SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') - -If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. - -If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding. - -If non-organizational users are not uniquely identified and authenticated, this is a finding.SRG-APP-000224-DB-000384<GroupDescription></GroupDescription>SQL6-D0-009200SQL Server must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.<VulnDiscussion>One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. - -The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. - -However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93909V-79203CCI-001188Configure Windows to require the use of FIPS compliant algorithms. - -Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsVerify that Windows is configured to require the use of FIPS compliant algorithms. - -Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -If the Security Setting for this option is "Disabled", this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009500SQL Server must protect the confidentiality and integrity of all information at rest.<VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. - -User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. - -If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93911V-79205CCI-001199Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption. - -To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on. - -Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. - -If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted. - -If full-disk encryption is being used, this is not a finding. - -If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing: - -SELECT -d.name AS [Database Name], -CASE e.encryption_state -WHEN 0 THEN 'No database encryption key present, no encryption' -WHEN 1 THEN 'Unencrypted' -WHEN 2 THEN 'Encryption in progress' -WHEN 3 THEN 'Encrypted' -WHEN 4 THEN 'Key change in progress' -WHEN 5 THEN 'Decryption in progress' -WHEN 6 THEN 'Protection change in progress' -END AS [Encryption State] -FROM sys.dm_database_encryption_keys e -RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name -WHERE d.name NOT IN ('master','model','msdb') -ORDER BY [Database Name] ; - -For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. - -Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009600The Service Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93913V-79207CCI-001199Document and implement procedures to safely back up and store the Service Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. Also, include provisions to store the key off-site. - -BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file' -ENCRYPTION BY PASSWORD = 'password'; - -As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.Review procedures for, and evidence of backup of, the Server Service Master Key in the System Security Plan. - -If the procedures or evidence does not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009700The Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93915V-79209CCI-001199Document and implement procedures to safely back up and store the Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Master Key. Also, include provisions to store the key off-site. - -BACKUP MASTER KEY TO FILE = 'path_to_file' -ENCRYPTION BY PASSWORD = 'password'; - -As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.If the application owner and Authorizing Official have determined that encryption of data at rest is not required, this is not a finding. - -Review procedures for, and evidence of backup of, the Master Key in the System Security Plan. - -If the procedures or evidence does not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Master Key backup, this is a finding.SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009800SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93917V-79211CCI-001090Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. - -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'common criteria compliance enabled', 1; -GO -RECONFIGURE -GOReview system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. - -SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. - -Review the Instance configuration: - - -SELECT value_in_use -FROM sys.configurations -WHERE name = 'common criteria compliance enabled' - -If "value_in_use" is set to "1" this is not a finding. -If "value_in_use" is set to "0" this is a finding. - -NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding. -SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009900SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93919V-79213CCI-001090If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.Review the system documentation to determine if Instant File Initialization (IFI) is required. - -If IFI is documented as required, this is not a finding. - -Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016). - -Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment - -If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance: NT SERVICE\MSSQL$InstanceName) has been granted "Perform volume maintenance tasks" Local Rights Assignment and if it is not documented in the system documentation, this is a finding.SRG-APP-000243-DB-000374<GroupDescription></GroupDescription>SQL6-D0-010000Access to database files must be limited to relevant processes and to authorized, administrative users.<VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93921V-79215CCI-001090Remove any unauthorized permission grants from SQL Server data, log, and backup directories. - -1) On the "Security" tab, highlight the user entry. -2) Click "Remove".Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. - -To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". - -For each of the directories returned by the above script, verify whether the correct permissions have been applied. - -1) Launch Windows Explorer. -2) Navigate to the folder. -3) Right-click the folder and click "Properties". -4) Navigate to the "Security" tab. -5) Review the listing of principals and permissions. - -Account Type Directory Type Permission ------------------------------------------------------------------------------------------------ -Database Administrators ALL Full Control -SQL Server Service SID Data; Log; Backup; Full Control -SQL Server Agent Service SID Backup Full Control -SYSTEM ALL Full Control -CREATOR OWNER ALL Full Control - -For information on how to determine a "Service SID", go to: -https://aka.ms/sql-service-sids - -Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: -https://aka.ms/sqlservicepermissions - -If any additional permissions are granted but not documented as authorized, this is a finding.SRG-APP-000267-DB-000163<GroupDescription></GroupDescription>SQL6-D0-010100SQL Server must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.<VulnDiscussion>If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. - -Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. - -It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93923V-79217CCI-001314Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. - -If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio. Use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles. - -If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. - -Consider enabling trace flag 3625 to mask certain system-level error information returned to non-administrative users. - -Launch SQL Server Configuration Manager >> Click SQL Services >> Open the instance properties >> Click the Service Parameters tab >> Enter "-T3625" >> Click Add >> Click OK >> Restart SQL instance.Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. - -SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: - -USE master -GO -SELECT Name -FROM syslogins -WHERE (sysadmin = 1 or securityadmin = 1) -and hasaccess = 1; - -If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. - -In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed. - -If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio, this is a finding.SRG-APP-000340-DB-000304<GroupDescription></GroupDescription>SQL6-D0-010400SQL Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.<VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. - -System documentation should include a definition of the functionality considered privileged. - -Depending on circumstances, privileged functions can include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. - -A privileged function in SQL Server/database context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: -CREATE -ALTER -DROP -GRANT -REVOKE -DENY - -There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples include: - -TRUNCATE TABLE; -DELETE, or -DELETE affecting more than n rows, for some n, or -DELETE without a WHERE clause; - -UPDATE or -UPDATE affecting more than n rows, for some n, or -UPDATE without a WHERE clause; - -Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. - -Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93925V-79219CCI-002235Restrict the granting of permissions to server-level securables to only those authorized. Most notably, members of sysadmin and securityadmin built-in instance-level roles, CONTROL SERVER permission, and use of the GRANT with GRANT permission.Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. - -Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. - -Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. - -Get all permission assignments to logins and roles: - -SELECT DISTINCT - CASE - WHEN SP.class_desc IS NOT NULL THEN - CASE - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' - ELSE SP.class_desc - END - WHEN E.name IS NOT NULL THEN 'ENDPOINT' - WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' - WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' - WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' - ELSE '???' - END AS [Securable Class], - CASE - WHEN E.name IS NOT NULL THEN E.name - WHEN S.name IS NOT NULL THEN S.name - WHEN P.name IS NOT NULL THEN P.name - ELSE '???' - END AS [Securable], - P1.name AS [Grantee], - P1.type_desc AS [Grantee Type], - sp.permission_name AS [Permission], - sp.state_desc AS [State], - P2.name AS [Grantor], - P2.type_desc AS [Grantor Type] -FROM - sys.server_permissions SP - INNER JOIN sys.server_principals P1 - ON P1.principal_id = SP.grantee_principal_id - INNER JOIN sys.server_principals P2 - ON P2.principal_id = SP.grantor_principal_id - - FULL OUTER JOIN sys.servers S - ON SP.class_desc = 'SERVER' - AND S.server_id = SP.major_id - - FULL OUTER JOIN sys.endpoints E - ON SP.class_desc = 'ENDPOINT' - AND E.endpoint_id = SP.major_id - - FULL OUTER JOIN sys.server_principals P - ON SP.class_desc = 'SERVER_PRINCIPAL' - AND P.principal_id = SP.major_id - -Get all server role memberships: - -SELECT - R.name AS [Role], - M.name AS [Member] -FROM - sys.server_role_members X - INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id - INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id - -The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) - -Ensure only the documented and approved logins have privileged functions in SQL Server. - -If the current configuration does not match the documented baseline, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-010500Use of credentials and proxies must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. - -Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93927V-79221CCI-002233Remove any SQL Agent Proxy accounts and credentials that are not authorized. - -DROP CREDENTIAL <Credential Name> -GO - -USE [msdb] -EXEC sp_delete_proxy @proxy_name = '<Proxy Name>' -GOReview the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. - -SELECT C.name AS credential_name, C.credential_identity -FROM sys.credentials C -GO - -SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity -FROM sys.credentials C -JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id -WHERE P.enabled = 1 -GO - -If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding.SRG-APP-000356-DB-000314<GroupDescription></GroupDescription>SQL6-D0-010700SQL Server must utilize centralized management of the content captured in audit records generated by all components of SQL Server.<VulnDiscussion>Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. - -The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. - -SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93929V-79223CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. - -If the SQL Server audit records are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000356-DB-000315<GroupDescription></GroupDescription>SQL6-D0-010800SQL Server must provide centralized configuration of the content to be captured in audit records generated by all components of SQL Server.<VulnDiscussion>If the configuration of SQL Server's auditing is spread across multiple locations in the database management software, or across multiple commands, only loosely related, it is harder to use and takes longer to reconfigure in response to events. - -SQL Server must provide a unified tool for audit configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93931V-79225CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records (to include traces used for audit purposes) are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. - -If the SQL Server audit records (to include traces used for audit purposes) are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000357-DB-000316<GroupDescription></GroupDescription>SQL6-D0-010900SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.<VulnDiscussion>In order to ensure sufficient storage capacity for the audit logs, SQL Server must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. - -The task of allocating audit record storage capacity is usually performed during initial installation of SQL Server and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. - -In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93933V-79227CCI-001849Review the SQL Audit file location, ensure the destination has enough space available to accommodate the maximum total size of all files that could be written. - -Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. - -Update the "max_files" parameter of the audits to ensure the correct number of files is defined.Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. - -SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path" -FROM sys.server_file_audits - -Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. - -If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.SRG-APP-000359-DB-000319<GroupDescription></GroupDescription>SQL6-D0-011000SQL Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.<VulnDiscussion>Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to SQL Server on its own server will not be an issue. However, space will still be required on the server for SQL Server audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. - -If support personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. - -The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. - -Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93935V-79229CCI-001855Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. - -If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.SRG-APP-000360-DB-000320<GroupDescription></GroupDescription>SQL6-D0-011100SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. - -The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. - -A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions - -Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93937V-79231CCI-001858Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. - -If real-time alerts are not sent upon auditing failure, this is a finding.SRG-APP-000374-DB-000322<GroupDescription></GroupDescription>SQL6-D0-011200SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).<VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. - -Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93939V-79233CCI-001890Where possible, configure the operating system to automatic synchronize with an official time server, using NTP. - -Where there is reason not to implement automatic synchronization with an official time server, using NTP, document the reason, and the procedure for maintaining the correct time, and obtain AO approval. Enforce the procedure.SQL Server audits store the timestamp in UTC time. - -Determine if the computer is joined to a domain. - -SELECT DEFAULT_DOMAIN()[DomainName] - -If this is not NULL, this is not a finding. - -If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) - - w32tm /query /source - -If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding. - -If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system. - -If such a procedure does not exist, this is a finding. - -If the procedure exists, review evidence that the correct time is actually maintained. - -If the evidence indicates otherwise, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011400SQL Server must enforce access restrictions associated with changes to the configuration of the instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. - -When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93941V-79235CCI-001813Revoke unauthorized permissions from principals. - -https://msdn.microsoft.com/en-us/library/ms186308.aspx - -Remove unauthorized logins from roles. - -ALTER SERVER ROLE DROP MEMBER login; - -https://technet.microsoft.com/en-us/library/ee677634.aspxObtain a list of logins who have privileged permissions and role memberships in SQL. - -Execute the following query to obtain a list of logins and roles and their respective permissions assignment: - -SELECT p.name AS Principal, -p.type_desc AS Type, -sp.permission_name AS Permission, -sp.state_desc AS State -FROM sys.server_principals p -INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id -WHERE sp.permission_name = 'CONTROL SERVER' -OR sp.state = 'W' - -Execute the following query to obtain a list of logins and their role memberships. - -SELECT m.name AS Member, -m.type_desc AS Type, -r.name AS Role -FROM sys.server_principals m -INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id -INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id -WHERE r.name IN ('sysadmin','securityadmin','serveradmin') - -Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011500Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. - -When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93943V-79237CCI-001813Remove users from the local Administrators group who are not authorized.Obtain a list of users who have privileged access to the server via the local Administrators group. - -Launch lusrmgr.msc -Select Groups -Double-click Administrators - -Alternatively, execute the following command in PowerShell: - -net localgroup administrators - -Check the server documentation to verify the users returned are authorized. - -If the users are not documented and authorized, this is a finding.SRG-APP-000381-DB-000361<GroupDescription></GroupDescription>SQL6-D0-011800SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).<VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. - -Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93945V-79239CCI-001814Add the required events to the server audit specification to audit denied actions. -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_ACCESS_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD -(DBCC_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP ); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO -Determine if an audit is configured to capture denied actions and started by executing the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the following events are included in the server audit specification: - -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, -AUDIT_CHANGE_GROUP, -BACKUP_RESTORE_GROUP, -DATABASE_CHANGE_GROUP, -DATABASE_OBJECT_ACCESS_GROUP, -DATABASE_OBJECT_CHANGE_GROUP, -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, -DATABASE_OWNERSHIP_CHANGE_GROUP, -DATABASE_OPERATION_GROUP, -DATABASE_PERMISSION_CHANGE_GROUP, -DATABASE_PRINCIPAL_CHANGE_GROUP, -DATABASE_PRINCIPAL_IMPERSONATION_GROUP, -DATABASE_ROLE_MEMBER_CHANGE_GROUP, -DBCC_GROUP, -LOGIN_CHANGE_PASSWORD_GROUP, -SCHEMA_OBJECT_CHANGE_GROUP, -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, -SERVER_OBJECT_CHANGE_GROUP, -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP, -SERVER_OBJECT_PERMISSION_CHANGE_GROUP, -SERVER_OPERATION_GROUP, -SERVER_PERMISSION_CHANGE_GROUP, -SERVER_PRINCIPAL_IMPERSONATION_GROUP, -SERVER_ROLE_MEMBER_CHANGE_GROUP, -SERVER_STATE_CHANGE_GROUP, -TRACE_CHANGE_GROUP - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ( -'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', -'AUDIT_CHANGE_GROUP', -'BACKUP_RESTORE_GROUP', -'DATABASE_CHANGE_GROUP', -'DATABASE_OBJECT_ACCESS_GROUP', -'DATABASE_OBJECT_CHANGE_GROUP', -'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', -'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', -'DATABASE_OWNERSHIP_CHANGE_GROUP', -'DATABASE_OPERATION_GROUP', -'DATABASE_PERMISSION_CHANGE_GROUP', -'DATABASE_PRINCIPAL_CHANGE_GROUP', -'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', -'DATABASE_ROLE_MEMBER_CHANGE_GROUP', -'DBCC_GROUP', -'LOGIN_CHANGE_PASSWORD_GROUP', -'SCHEMA_OBJECT_CHANGE_GROUP', -'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', -'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', -'SERVER_OBJECT_CHANGE_GROUP', -'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', -'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', -'SERVER_OPERATION_GROUP', -'SERVER_PERMISSION_CHANGE_GROUP', -'SERVER_PRINCIPAL_IMPERSONATION_GROUP', -'SERVER_ROLE_MEMBER_CHANGE_GROUP', -'SERVER_STATE_CHANGE_GROUP', -'TRACE_CHANGE_GROUP' -) -Order by d.audit_action_name - -If the identified groups are not returned, this is a finding.SRG-APP-000383-DB-000364<GroupDescription></GroupDescription>SQL6-D0-011900SQL Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.<VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93947V-79241CCI-001762Assign the approved TCP/IP port number to the SQL Server Database Engine. -1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for <instance name>, and then double-click "TCP/IP". -2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. -3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". -4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". -5. In the console pane, click "SQL Server Services". -6. In the details pane, right-click "SQL Server (<instance name>)" and then click "Restart", to stop and restart SQL Server. - -To disable a server network protocol for an instance: -1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. -2. In the console pane, click "Protocols" for <instance name>. -3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". -4. In the console pane, click "SQL Server Services". -5. In the details pane, right-click "SQL Server (<instance name>)", and then click "Restart", to stop and restart the SQL Server service.SQL Server must only use approved network communication libraries, ports, and protocols. - -Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. - -Verify that the protocols are enabled for the instance. - -If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012300SQL Server must maintain a separate execution domain for each executing process.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. - -Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. - -Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93949V-79243CCI-002530Disable CLR support in SQL Server by executing the following query: - -EXEC sp_configure 'clr enabled', 0 -GO - -RECONFIGURE -GOReview the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: - -SELECT name, value, value_in_use -FROM sys.configurations -WHERE name = 'clr enabled' - -If "value_in_use" is a "1" and CLR is not required, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012400SQL Server services must be configured to run under unique dedicated user accounts.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93951V-79245CCI-002530Configure SQL Server services to have a documented, dedicated account. - -For non-domain servers, consider using virtual service accounts (VSA). See https://msdn.microsoft.com/en-us/library/ms143504.aspx#VA_Desc for more information. - -For standalone, domain-joined servers, consider using managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#MSA for more information. - -For clustered instances, consider using group managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#GMSA or https://blogs.msdn.microsoft.com/markweberblog/2016/05/25/group-managed-service-accounts-gmsa-and-sql-server-2016/ for more information.Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. - -Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. - -If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding.SRG-APP-000454-DB-000389<GroupDescription></GroupDescription>SQL6-D0-012700When updates are applied to SQL Server software, any software components that have been replaced or made unnecessary must be removed.<VulnDiscussion>Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. - -Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. - -A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93953V-79247CCI-002617Remove all features that are not required.From the server documentation, obtain a listing of required components. - -Generate a listing of components installed on the server. - -Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" - -Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.SRG-APP-000456-DB-000390<GroupDescription></GroupDescription>SQL6-D0-012800Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).<VulnDiscussion>Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. - -Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). - -This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. - -SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93955V-79249CCI-002605Upgrade SQL Server to the Microsoft-supported version. Institute and adhere to policies and procedures to ensure that patches are consistently applied to SQL Server within the time allowed.Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://support.microsoft.com/en-us/lifecycle?C2=1044 - -Check the SQL Server Version by running the following script: Print @@version - -If the SQL Server version is not shown as supported, this is a finding. - -If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding.SRG-APP-000492-DB-000332<GroupDescription></GroupDescription>SQL6-D0-012900SQL Server must be able to generate audit records when security objects are accessed.<VulnDiscussion>Changes to the security configuration must be tracked. - -This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93957V-79251CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000492-DB-000333<GroupDescription></GroupDescription>SQL6-D0-013000SQL Server must generate audit records when unsuccessful attempts to access security objects occur.<VulnDiscussion>Changes to the security configuration must be tracked. - -This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93959V-79253CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_statu - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000344<GroupDescription></GroupDescription>SQL6-D0-013100SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is accessed.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93961V-79255CCI-000172Deploy an audit to audit when data classifications are retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are retrieved. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000345<GroupDescription></GroupDescription>SQL6-D0-013200SQL Server must generate audit records when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93963V-79257CCI-000172Deploy an audit to audit when data classifications are unsuccessfully retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully retrieved. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000495-DB-000326<GroupDescription></GroupDescription>SQL6-D0-013300SQL Server must generate audit records when privileges/permissions are added.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93965V-79259CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000495-DB-000327<GroupDescription></GroupDescription>SQL6-D0-013400SQL Server must generate audit records when unsuccessful attempts to add privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93967V-79261CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000495-DB-000328<GroupDescription></GroupDescription>SQL6-D0-013500SQL Server must generate audit records when privileges/permissions are modified.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93969V-79263CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000495-DB-000329<GroupDescription></GroupDescription>SQL6-D0-013600SQL Server must generate audit records when unsuccessful attempts to modify privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93971V-79265CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000496-DB-000334<GroupDescription></GroupDescription>SQL6-D0-013700SQL Server must generate audit records when security objects are modified.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93973V-79267CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query: - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' +4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000496-DB-000335<GroupDescription></GroupDescription>SQL6-D0-013800SQL Server must generate audit records when unsuccessful attempts to modify security objects occur.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. +5. This check needs to be run on each node of the cluster. -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93975V-79269CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO +If any nodes have a certificate in use by SQL that is not issued by DOD, this is a finding. +SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008300Confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-106625V-97521CCI-000197 +Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure you have a recent backup of the system and registry settings. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Enable TLS 1.2: + +1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols + a.If the "TLS 1.2" key does not exist, right-click "Protocols" + b.Click New + c.Click Key + d.Type the name "TLS 1.2" -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO +2.Navigate to the "TLS 1.2" subkey + a.If the subkey "Client" does not exist, right-click "TLS 1.2" + b.Click New + c.Click Key + d.Type the name "Client" + e.Repeat steps A – D for the "Server" subkey -See supplemental script "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query: +3.Navigate to the "Client" subkey + a.If the value "Enabled" does not exist, right-click on "Client" + b.Click New + c.Click DWORD + d.Enter "Enabled" as the name + e.Repeat steps A-D for the value "DisabledByDefault" -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +4.Double-click "Enabled" -If no records are returned, this is a finding. +5.In Value Data, enter "1" -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. +6.Click OK -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' +7.Double-click "DisabledByDefault" -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000346<GroupDescription></GroupDescription>SQL6-D0-013900SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is modified.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. +8.In Value Data, enter "0" -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93977V-79271CCI-000172Deploy an audit to audit when data classifications are modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are modified. +9.Click OK -If this is not required, this is not a finding. +10.Repeat steps 3 – 9 for the "Server" subkey + -If the documentation does not exist, this is a finding. +Disable unwanted SSL/TLS protocol versions: -Determine if an audit is configured and started by executing the following query. +1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols + a.If the "TLS 1.0" key does not exist, right-click "Protocols" + b.Click New + c.Click Key + d.Type the name "TLS 1.0" -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +2.Navigate to the "TLS 1.0" subkey + a.If the subkey "Client" does not exist, right-click "TLS 1.0" + b.Click New + c.Click Key + d.Type the name "Client" + e.Repeat steps A – D for the "Server" subkey -If no records are returned, this is a finding. +3.Navigate to the "Client" subkey + a.If the value "Enabled" does not exist, right-click on "Client" + b.Click New + c.Click DWORD + d.Enter "Enabled" as the name + e.Repeat steps A-D for the value "DisabledByDefault" -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. +4.Double-click "Enabled" -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +5.In Value Data, enter "0" -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000347<GroupDescription></GroupDescription>SQL6-D0-014000SQL Server must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. +6.Click OK -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. +7.Double-click "DisabledByDefault" -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93979V-79273CCI-000172Deploy an audit to audit when data classifications are unsuccessfully modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully modified. +8.In Value Data, enter "1" -If this is not required, this is not a finding. +9.Click OK -If the documentation does not exist, this is a finding. +10.Repeat steps 3 – 9 for the "Server" subkey -Determine if an audit is configured and started by executing the following query. +11.Repeat steps 1 – 10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0" + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +If this key does not exist, this is a Finding. -If no records are returned, this is a finding. +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. +SRG-APP-000176-DB-000068<GroupDescription></GroupDescription>SQL6-D0-008400SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. + +If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where SQL Server-stored private keys are used to authenticate SQL Server to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against SQL Server system and its clients. + +Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. + +All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93903V-79197CCI-000186Enable use of FIPS 140-2 compliant algorithms. + +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options + +Double-click "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing." + +Click Enabled >> Apply.Review system configuration to determine whether FIPS 140-2 support has been enabled. + +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options + +Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. + +If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. + +For more information, see https://support.microsoft.com/en-us/kb/3141890.SRG-APP-000179-DB-000114<GroupDescription></GroupDescription>SQL6-D0-008700SQL Server must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.<VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of SQL Server. + +Applications, including DBMSs, utilizing cryptography are required to use approved NIST FIPS 140-2 validated cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. + +The security functions validated as part of FIPS 140-2 for cryptographic modules are described in FIPS 140-2 Annex A. + +NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93905V-79199CCI-000803In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +In the dialog box that appears, if the radio buttons are active, click "Enabled", and then click "Apply". If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If, in the "Security Setting" column, the value is "Disabled," this is a finding. + +https://support.microsoft.com/en-us/kb/955720SRG-APP-000180-DB-000115<GroupDescription></GroupDescription>SQL6-D0-008800SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).<VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). + +Non-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. + +Accordingly, a risk assessment is used in determining the authentication needs of the organization. + +Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93907V-79201CCI-000804Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. + +Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: + +SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') + +If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. + +If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding. + +If non-organizational users are not uniquely identified and authenticated, this is a finding.SRG-APP-000224-DB-000384<GroupDescription></GroupDescription>SQL6-D0-009200SQL Server must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.<VulnDiscussion>One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. + +The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. + +However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93909V-79203CCI-001188Configure Windows to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsVerify that Windows is configured to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If the Security Setting for this option is "Disabled", this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009500SQL Server must protect the confidentiality and integrity of all information at rest.<VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. + +User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. + +If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93911V-79205CCI-001199Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption. -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on. -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000499-DB-000330<GroupDescription></GroupDescription>SQL6-D0-014100SQL Server must generate audit records when privileges/permissions are deleted.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. +Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. + +If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted. + +If full-disk encryption is being used, this is not a finding. + +If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing: + +SELECT +d.name AS [Database Name], +CASE e.encryption_state +WHEN 0 THEN 'No database encryption key present, no encryption' +WHEN 1 THEN 'Unencrypted' +WHEN 2 THEN 'Encryption in progress' +WHEN 3 THEN 'Encrypted' +WHEN 4 THEN 'Key change in progress' +WHEN 5 THEN 'Decryption in progress' +WHEN 6 THEN 'Protection change in progress' +END AS [Encryption State] +FROM sys.dm_database_encryption_keys e +RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name +WHERE d.name NOT IN ('master','model','msdb') +ORDER BY [Database Name] ; + +For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. + +Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009600The Service Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93913V-79207CCI-001199Document and implement procedures to safely back up and store the Service Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. Also, include provisions to store the key off-site. + +BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file' +ENCRYPTION BY PASSWORD = 'password'; + +As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.Review procedures for, and evidence of backup of, the Server Service Master Key in the System Security Plan. + +If the procedures or evidence does not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009700The Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93915V-79209CCI-001199Document and implement procedures to safely back up and store the Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Master Key. Also, include provisions to store the key off-site. + +BACKUP MASTER KEY TO FILE = 'path_to_file' +ENCRYPTION BY PASSWORD = 'password'; + +As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.If the application owner and Authorizing Official have determined that encryption of data at rest is not required, this is not a finding. + +Review procedures for, and evidence of backup of, the Master Key in the System Security Plan. + +If the procedures or evidence does not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Master Key backup, this is a finding.SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009800SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93917V-79211CCI-001090Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. + +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'common criteria compliance enabled', 1; +GO +RECONFIGURE +GOReview system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. + +SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. + +Review the Instance configuration: -In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93981V-79275CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP +SELECT value_in_use +FROM sys.configurations +WHERE name = 'common criteria compliance enabled' -See the supplemental file "SQL 2016 Audit.sql". +If "value_in_use" is set to "1" this is not a finding. +If "value_in_use" is set to "0" this is a finding. -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000499-DB-000331<GroupDescription></GroupDescription>SQL6-D0-014200SQL Server must generate audit records when unsuccessful attempts to delete privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93983V-79277CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP +NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding. +SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009900SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93919V-79213CCI-001090If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.Review the system documentation to determine if Instant File Initialization (IFI) is required. -See the supplemental file "SQL 2016 Audit.sql". +If IFI is documented as required, this is not a finding. -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000501-DB-000336<GroupDescription></GroupDescription>SQL6-D0-014300SQL Server must generate audit records when security objects are deleted.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93985V-79279CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO +Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016). -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO +If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance: NT SERVICE\MSSQL$InstanceName) has been granted "Perform volume maintenance tasks" Local Rights Assignment and if it is not documented in the system documentation, this is a finding.SRG-APP-000243-DB-000374<GroupDescription></GroupDescription>SQL6-D0-010000Access to database files must be limited to relevant processes and to authorized, administrative users.<VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93921V-79215CCI-001090Remove any unauthorized permission grants from SQL Server data, log, and backup directories. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO +1) On the "Security" tab, highlight the user entry. +2) Click "Remove".Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. -See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. +To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +For each of the directories returned by the above script, verify whether the correct permissions have been applied. -If no records are returned, this is a finding. +1) Launch Windows Explorer. +2) Navigate to the folder. +3) Right-click the folder and click "Properties". +4) Navigate to the "Security" tab. +5) Review the listing of principals and permissions. -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. +Account Type Directory Type Permission +----------------------------------------------------------------------------------------------- +Database Administrators ALL Full Control +SQL Server Service SID Data; Log; Backup; Full Control +SQL Server Agent Service SID Backup Full Control +SYSTEM ALL Full Control +CREATOR OWNER ALL Full Control -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' +For information on how to determine a "Service SID", go to: +https://aka.ms/sql-service-sids -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000501-DB-000337<GroupDescription></GroupDescription>SQL6-D0-014400SQL Server must generate audit records when unsuccessful attempts to delete security objects occur.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. +Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: +https://aka.ms/sqlservicepermissions -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93987V-79281CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO +If any additional permissions are granted but not documented as authorized, this is a finding.SRG-APP-000267-DB-000163<GroupDescription></GroupDescription>SQL6-D0-010100SQL Server must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.<VulnDiscussion>If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. + +Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. + +It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93923V-79217CCI-001314Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. + +If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio. Use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles. + +If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. + +Consider enabling trace flag 3625 to mask certain system-level error information returned to non-administrative users. + +Launch SQL Server Configuration Manager >> Click SQL Services >> Open the instance properties >> Click the Service Parameters tab >> Enter "-T3625" >> Click Add >> Click OK >> Restart SQL instance.Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. + +SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: + +USE master +GO +SELECT Name +FROM syslogins +WHERE (sysadmin = 1 or securityadmin = 1) +and hasaccess = 1; + +If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. + +In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed. + +If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio, this is a finding.SRG-APP-000340-DB-000304<GroupDescription></GroupDescription>SQL6-D0-010400SQL Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.<VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. + +System documentation should include a definition of the functionality considered privileged. + +Depending on circumstances, privileged functions can include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. + +A privileged function in SQL Server/database context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples include: + +TRUNCATE TABLE; +DELETE, or +DELETE affecting more than n rows, for some n, or +DELETE without a WHERE clause; + +UPDATE or +UPDATE affecting more than n rows, for some n, or +UPDATE without a WHERE clause; + +Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. + +Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93925V-79219CCI-002235Restrict the granting of permissions to server-level securables to only those authorized. Most notably, members of sysadmin and securityadmin built-in instance-level roles, CONTROL SERVER permission, and use of the GRANT with GRANT permission.Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. + +Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. + +Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. + +Get all permission assignments to logins and roles: + +SELECT DISTINCT + CASE + WHEN SP.class_desc IS NOT NULL THEN + CASE + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' + ELSE SP.class_desc + END + WHEN E.name IS NOT NULL THEN 'ENDPOINT' + WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' + WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' + WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' + ELSE '???' + END AS [Securable Class], + CASE + WHEN E.name IS NOT NULL THEN E.name + WHEN S.name IS NOT NULL THEN S.name + WHEN P.name IS NOT NULL THEN P.name + ELSE '???' + END AS [Securable], + P1.name AS [Grantee], + P1.type_desc AS [Grantee Type], + sp.permission_name AS [Permission], + sp.state_desc AS [State], + P2.name AS [Grantor], + P2.type_desc AS [Grantor Type] +FROM + sys.server_permissions SP + INNER JOIN sys.server_principals P1 + ON P1.principal_id = SP.grantee_principal_id + INNER JOIN sys.server_principals P2 + ON P2.principal_id = SP.grantor_principal_id + + FULL OUTER JOIN sys.servers S + ON SP.class_desc = 'SERVER' + AND S.server_id = SP.major_id + + FULL OUTER JOIN sys.endpoints E + ON SP.class_desc = 'ENDPOINT' + AND E.endpoint_id = SP.major_id + + FULL OUTER JOIN sys.server_principals P + ON SP.class_desc = 'SERVER_PRINCIPAL' + AND P.principal_id = SP.major_id + +Get all server role memberships: + +SELECT + R.name AS [Role], + M.name AS [Member] +FROM + sys.server_role_members X + INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id + INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id + +The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) + +Ensure only the documented and approved logins have privileged functions in SQL Server. + +If the current configuration does not match the documented baseline, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-010500Use of credentials and proxies must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. + +Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93927V-79221CCI-002233Remove any SQL Agent Proxy accounts and credentials that are not authorized. + +DROP CREDENTIAL <Credential Name> +GO + +USE [msdb] +EXEC sp_delete_proxy @proxy_name = '<Proxy Name>' +GOReview the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. + +SELECT C.name AS credential_name, C.credential_identity +FROM sys.credentials C +GO + +SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity +FROM sys.credentials C +JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id +WHERE P.enabled = 1 +GO + +If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding.SRG-APP-000356-DB-000314<GroupDescription></GroupDescription>SQL6-D0-010700SQL Server must utilize centralized management of the content captured in audit records generated by all components of SQL Server.<VulnDiscussion>Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. + +The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. + +SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93929V-79223CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. + +If the SQL Server audit records are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000356-DB-000315<GroupDescription></GroupDescription>SQL6-D0-010800SQL Server must provide centralized configuration of the content to be captured in audit records generated by all components of SQL Server.<VulnDiscussion>If the configuration of SQL Server's auditing is spread across multiple locations in the database management software, or across multiple commands, only loosely related, it is harder to use and takes longer to reconfigure in response to events. + +SQL Server must provide a unified tool for audit configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93931V-79225CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records (to include traces used for audit purposes) are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. + +If the SQL Server audit records (to include traces used for audit purposes) are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000357-DB-000316<GroupDescription></GroupDescription>SQL6-D0-010900SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.<VulnDiscussion>In order to ensure sufficient storage capacity for the audit logs, SQL Server must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. + +The task of allocating audit record storage capacity is usually performed during initial installation of SQL Server and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. + +In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93933V-79227CCI-001849Review the SQL Audit file location, ensure the destination has enough space available to accommodate the maximum total size of all files that could be written. + +Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. + +Update the "max_files" parameter of the audits to ensure the correct number of files is defined.Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. + +SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path" +FROM sys.server_file_audits + +Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. + +If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.SRG-APP-000359-DB-000319<GroupDescription></GroupDescription>SQL6-D0-011000SQL Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.<VulnDiscussion>Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to SQL Server on its own server will not be an issue. However, space will still be required on the server for SQL Server audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. + +If support personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. + +The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. + +Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93935V-79229CCI-001855Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. + +If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.SRG-APP-000360-DB-000320<GroupDescription></GroupDescription>SQL6-D0-011100SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. + +The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO +Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93937V-79231CCI-001858Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +If real-time alerts are not sent upon auditing failure, this is a finding.SRG-APP-000374-DB-000322<GroupDescription></GroupDescription>SQL6-D0-011200SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).<VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. + +Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93939V-79233CCI-001890Where possible, configure the operating system to automatic synchronize with an official time server, using NTP. + +Where there is reason not to implement automatic synchronization with an official time server, using NTP, document the reason, and the procedure for maintaining the correct time, and obtain AO approval. Enforce the procedure.SQL Server audits store the timestamp in UTC time. + +Determine if the computer is joined to a domain. + +SELECT DEFAULT_DOMAIN()[DomainName] + +If this is not NULL, this is not a finding. + +If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) + + w32tm /query /source + +If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding. + +If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system. + +If such a procedure does not exist, this is a finding. + +If the procedure exists, review evidence that the correct time is actually maintained. + +If the evidence indicates otherwise, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011400SQL Server must enforce access restrictions associated with changes to the configuration of the instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. + +When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93941V-79235CCI-001813Revoke unauthorized permissions from principals. + +https://msdn.microsoft.com/en-us/library/ms186308.aspx + +Remove unauthorized logins from roles. + +ALTER SERVER ROLE DROP MEMBER login; + +https://technet.microsoft.com/en-us/library/ee677634.aspxObtain a list of logins who have privileged permissions and role memberships in SQL. + +Execute the following query to obtain a list of logins and roles and their respective permissions assignment: + +SELECT p.name AS Principal, +p.type_desc AS Type, +sp.permission_name AS Permission, +sp.state_desc AS State +FROM sys.server_principals p +INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id +WHERE sp.permission_name = 'CONTROL SERVER' +OR sp.state = 'W' + +Execute the following query to obtain a list of logins and their role memberships. + +SELECT m.name AS Member, +m.type_desc AS Type, +r.name AS Role +FROM sys.server_principals m +INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id +INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id +WHERE r.name IN ('sysadmin','securityadmin','serveradmin') + +Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011500Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. + +When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93943V-79237CCI-001813Remove users from the local Administrators group who are not authorized.Obtain a list of users who have privileged access to the server via the local Administrators group. + +Launch lusrmgr.msc +Select Groups +Double-click Administrators + +Alternatively, execute the following command in PowerShell: + +net localgroup administrators + +Check the server documentation to verify the users returned are authorized. + +If the users are not documented and authorized, this is a finding.SRG-APP-000381-DB-000361<GroupDescription></GroupDescription>SQL6-D0-011800SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).<VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. + +Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93945V-79239CCI-001814Add the required events to the server audit specification to audit denied actions. +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_ACCESS_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD +(DBCC_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP ); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); GO - -See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. +Determine if an audit is configured to capture denied actions and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', @@ -2634,7 +1852,36 @@ FROM sys.dm_server_audit_status If no records are returned, this is a finding. -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, +AUDIT_CHANGE_GROUP, +BACKUP_RESTORE_GROUP, +DATABASE_CHANGE_GROUP, +DATABASE_OBJECT_ACCESS_GROUP, +DATABASE_OBJECT_CHANGE_GROUP, +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, +DATABASE_OWNERSHIP_CHANGE_GROUP, +DATABASE_OPERATION_GROUP, +DATABASE_PERMISSION_CHANGE_GROUP, +DATABASE_PRINCIPAL_CHANGE_GROUP, +DATABASE_PRINCIPAL_IMPERSONATION_GROUP, +DATABASE_ROLE_MEMBER_CHANGE_GROUP, +DBCC_GROUP, +LOGIN_CHANGE_PASSWORD_GROUP, +SCHEMA_OBJECT_CHANGE_GROUP, +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, +SERVER_OBJECT_CHANGE_GROUP, +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP, +SERVER_OBJECT_PERMISSION_CHANGE_GROUP, +SERVER_OPERATION_GROUP, +SERVER_PERMISSION_CHANGE_GROUP, +SERVER_PRINCIPAL_IMPERSONATION_GROUP, +SERVER_ROLE_MEMBER_CHANGE_GROUP, +SERVER_STATE_CHANGE_GROUP, +TRACE_CHANGE_GROUP SELECT a.name AS 'AuditName', s.name AS 'SpecName', @@ -2643,41 +1890,175 @@ d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' - -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000348<GroupDescription></GroupDescription>SQL6-D0-014500SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is deleted.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93989V-79283CCI-000172Deploy an audit to audit when data classifications are deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are deleted. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ( +'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', +'AUDIT_CHANGE_GROUP', +'BACKUP_RESTORE_GROUP', +'DATABASE_CHANGE_GROUP', +'DATABASE_OBJECT_ACCESS_GROUP', +'DATABASE_OBJECT_CHANGE_GROUP', +'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', +'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', +'DATABASE_OWNERSHIP_CHANGE_GROUP', +'DATABASE_OPERATION_GROUP', +'DATABASE_PERMISSION_CHANGE_GROUP', +'DATABASE_PRINCIPAL_CHANGE_GROUP', +'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', +'DATABASE_ROLE_MEMBER_CHANGE_GROUP', +'DBCC_GROUP', +'LOGIN_CHANGE_PASSWORD_GROUP', +'SCHEMA_OBJECT_CHANGE_GROUP', +'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', +'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', +'SERVER_OBJECT_CHANGE_GROUP', +'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', +'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', +'SERVER_OPERATION_GROUP', +'SERVER_PERMISSION_CHANGE_GROUP', +'SERVER_PRINCIPAL_IMPERSONATION_GROUP', +'SERVER_ROLE_MEMBER_CHANGE_GROUP', +'SERVER_STATE_CHANGE_GROUP', +'TRACE_CHANGE_GROUP' +) +Order by d.audit_action_name -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' +If the identified groups are not returned, this is a finding.SRG-APP-000383-DB-000364<GroupDescription></GroupDescription>SQL6-D0-011900SQL Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.<VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93947V-79241CCI-001762Assign the approved TCP/IP port number to the SQL Server Database Engine. +1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for <instance name>, and then double-click "TCP/IP". +2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. +3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". +4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". +5. In the console pane, click "SQL Server Services". +6. In the details pane, right-click "SQL Server (<instance name>)" and then click "Restart", to stop and restart SQL Server. + +To disable a server network protocol for an instance: +1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. +2. In the console pane, click "Protocols" for <instance name>. +3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". +4. In the console pane, click "SQL Server Services". +5. In the details pane, right-click "SQL Server (<instance name>)", and then click "Restart", to stop and restart the SQL Server service.SQL Server must only use approved network communication libraries, ports, and protocols. + +Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. + +Verify that the protocols are enabled for the instance. + +If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012300SQL Server must maintain a separate execution domain for each executing process.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. + +Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. + +Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93949V-79243CCI-002530Disable CLR support in SQL Server by executing the following query: + +EXEC sp_configure 'clr enabled', 0 +GO + +RECONFIGURE +GOReview the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: + +SELECT name, value, value_in_use +FROM sys.configurations +WHERE name = 'clr enabled' + +If "value_in_use" is a "1" and CLR is not required, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012400SQL Server services must be configured to run under unique dedicated user accounts.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93951V-79245CCI-002530Configure SQL Server services to have a documented, dedicated account. + +For non-domain servers, consider using virtual service accounts (VSA). See https://msdn.microsoft.com/en-us/library/ms143504.aspx#VA_Desc for more information. + +For standalone, domain-joined servers, consider using managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#MSA for more information. + +For clustered instances, consider using group managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#GMSA or https://blogs.msdn.microsoft.com/markweberblog/2016/05/25/group-managed-service-accounts-gmsa-and-sql-server-2016/ for more information.Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. + +Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. + +If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding.SRG-APP-000454-DB-000389<GroupDescription></GroupDescription>SQL6-D0-012700When updates are applied to SQL Server software, any software components that have been replaced or made unnecessary must be removed.<VulnDiscussion>Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. + +Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. + +A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93953V-79247CCI-002617Remove all features that are not required.From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.SRG-APP-000456-DB-000390<GroupDescription></GroupDescription>SQL6-D0-012800Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).<VulnDiscussion>Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + +Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). + +This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. + +SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93955V-79249CCI-002605Upgrade SQL Server to the Microsoft-supported version. Institute and adhere to policies and procedures to ensure that patches are consistently applied to SQL Server within the time allowed.Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://support.microsoft.com/en-us/lifecycle?C2=1044 + +Check the SQL Server Version by running the following script: Print @@version + +If the SQL Server version is not shown as supported, this is a finding. + +If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding.SRG-APP-000492-DB-000332<GroupDescription></GroupDescription>SQL6-D0-012900SQL Server must be able to generate audit records when security objects are accessed.<VulnDiscussion>Changes to the security configuration must be tracked. + +This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93957V-79251CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000349<GroupDescription></GroupDescription>SQL6-D0-014600SQL Server must generate audit records when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93991V-79285CCI-000172Deploy an audit to audit when data classifications are unsuccessfully deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully deleted. +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000492-DB-000333<GroupDescription></GroupDescription>SQL6-D0-013000SQL Server must generate audit records when unsuccessful attempts to access security objects occur.<VulnDiscussion>Changes to the security configuration must be tracked. + +This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93959V-79253CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_statu + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000344<GroupDescription></GroupDescription>SQL6-D0-013100SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is accessed.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93961V-79255CCI-000172Deploy an audit to audit when data classifications are retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are retrieved. If this is not required, this is not a finding. @@ -2686,323 +2067,942 @@ If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query. SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status If no records are returned, this is a finding. -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. +If auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000503-DB-000350<GroupDescription></GroupDescription>SQL6-D0-014700SQL Server must generate audit records when successful logons or connections occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93993V-79287CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO - -Alternatively, enable "Both failed and successful logins" -In SQL Management Studio -Right-click on the instance ->> Select "Properties" ->> Select "Security" on the left hand side ->> Select "Both failed and successful logins" ->> Click "OK"Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000345<GroupDescription></GroupDescription>SQL6-D0-013200SQL Server must generate audit records when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93963V-79257CCI-000172Deploy an audit to audit when data classifications are unsuccessfully retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully retrieved. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000495-DB-000326<GroupDescription></GroupDescription>SQL6-D0-013300SQL Server must generate audit records when privileges/permissions are added.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93965V-79259CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status -Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' - -If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. - -If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. +Execute the following query to verify the required audit actions are included in the server audit specification: -In SQL Management Studio -Right-click on the instance ->> Select "Properties" ->> Select "Security" on the left hand side ->> Check the setting for "Login auditing" - -If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000503-DB-000351<GroupDescription></GroupDescription>SQL6-D0-014800SQL Server must generate audit records when unsuccessful logons or connection attempts occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93995V-79289CCI-000172Add the "FAILED_LOGIN_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (FAILED_LOGIN_GROUP); -GO +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query. +If the any of the following audit actions are not returned in an active audit, this is a finding. -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000495-DB-000327<GroupDescription></GroupDescription>SQL6-D0-013400SQL Server must generate audit records when unsuccessful attempts to add privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93967V-79261CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status -If no records are returned, this is a finding. - -Execute the following query to verify the "FAILED_LOGIN_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' - -If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000504-DB-000354<GroupDescription></GroupDescription>SQL6-D0-014900SQL Server must generate audit records for all privileged activities or other system-level access.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. - -System documentation should include a definition of the functionality considered privileged. - -A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: -CREATE -ALTER -DROP -GRANT -REVOKE -DENY - -There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples in SQL include: - -TRUNCATE TABLE; -DELETE, or -DELETE affecting more than n rows, for some n, or -DELETE without a WHERE clause; - -UPDATE or -UPDATE affecting more than n rows, for some n, or -UPDATE without a WHERE clause; - -any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. - -Depending on the capabilities of SQL Server and the design of the database and associated applications, audit logging may be achieved by means of DBMS auditing features, database triggers, other mechanisms, or a combination of these. - -Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93997V-79291CCI-000172Add the required events to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +Execute the following query to verify the required audit actions are included in the server audit specification: -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -If no records are returned, this is a finding. +If the any of the following audit actions are not returned in an active audit, this is a finding. -Execute the following query to verify the following events are included in the server audit specification: +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000495-DB-000328<GroupDescription></GroupDescription>SQL6-D0-013500SQL Server must generate audit records when privileges/permissions are modified.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93969V-79263CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP -AUDIT_CHANGE_GROUP -BACKUP_RESTORE_GROUP -DATABASE_CHANGE_GROUP -DATABASE_OBJECT_CHANGE_GROUP -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OPERATION_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_PRINCIPAL_CHANGE_GROUP -DATABASE_PRINCIPAL_IMPERSONATION_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -DBCC_GROUP -LOGIN_CHANGE_PASSWORD_GROUP -SCHEMA_OBJECT_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OPERATION_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_PRINCIPAL_CHANGE_GROUP -SERVER_PRINCIPAL_IMPERSONATION_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP -SERVER_STATE_CHANGE_GROUP -TRACE_CHANGE_GROUP -USER_CHANGE_PASSWORD_GROUP +Execute the following query to verify the required audit actions are included in the server audit specification: -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') - -If the identified groups are not returned, this is a finding.SRG-APP-000504-DB-000355<GroupDescription></GroupDescription>SQL6-D0-015000SQL Server must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. - -System documentation should include a definition of the functionality considered privileged. - -A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: -CREATE -ALTER -DROP -GRANT -REVOKE -DENY +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity. +If the any of the following audit actions are not returned in an active audit, this is a finding. -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93999V-79293CCI-000172Add the required events to the server audit specification -USE [master]; -GO -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); -GO +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000495-DB-000329<GroupDescription></GroupDescription>SQL6-D0-013600SQL Server must generate audit records when unsuccessful attempts to modify privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93971V-79265CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO -Determine if an audit is configured and started by executing the following query. +Execute the following query to verify the required audit actions are included in the server audit specification: -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -If no records are returned, this is a finding. +If the any of the following audit actions are not returned in an active audit, this is a finding. -Execute the following query to verify the following events are included in the server audit specification: +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000496-DB-000334<GroupDescription></GroupDescription>SQL6-D0-013700SQL Server must generate audit records when security objects are modified.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93973V-79267CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000496-DB-000335<GroupDescription></GroupDescription>SQL6-D0-013800SQL Server must generate audit records when unsuccessful attempts to modify security objects occur.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93975V-79269CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +See supplemental script "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000346<GroupDescription></GroupDescription>SQL6-D0-013900SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is modified.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93977V-79271CCI-000172Deploy an audit to audit when data classifications are modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are modified. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000347<GroupDescription></GroupDescription>SQL6-D0-014000SQL Server must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93979V-79273CCI-000172Deploy an audit to audit when data classifications are unsuccessfully modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully modified. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000499-DB-000330<GroupDescription></GroupDescription>SQL6-D0-014100SQL Server must generate audit records when privileges/permissions are deleted.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93981V-79275CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. + +If the following events are not included, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000499-DB-000331<GroupDescription></GroupDescription>SQL6-D0-014200SQL Server must generate audit records when unsuccessful attempts to delete privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93983V-79277CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP -AUDIT_CHANGE_GROUP -BACKUP_RESTORE_GROUP -DATABASE_CHANGE_GROUP -DATABASE_OBJECT_CHANGE_GROUP -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OPERATION_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_PRINCIPAL_CHANGE_GROUP -DATABASE_PRINCIPAL_IMPERSONATION_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -DBCC_GROUP +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. + +If the following events are not included, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000501-DB-000336<GroupDescription></GroupDescription>SQL6-D0-014300SQL Server must generate audit records when security objects are deleted.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93985V-79279CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000501-DB-000337<GroupDescription></GroupDescription>SQL6-D0-014400SQL Server must generate audit records when unsuccessful attempts to delete security objects occur.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93987V-79281CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000348<GroupDescription></GroupDescription>SQL6-D0-014500SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is deleted.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93989V-79283CCI-000172Deploy an audit to audit when data classifications are deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are deleted. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000349<GroupDescription></GroupDescription>SQL6-D0-014600SQL Server must generate audit records when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93991V-79285CCI-000172Deploy an audit to audit when data classifications are unsuccessfully deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully deleted. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000503-DB-000350<GroupDescription></GroupDescription>SQL6-D0-014700SQL Server must generate audit records when successful logons or connections occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93993V-79287CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +Alternatively, enable "Both failed and successful logins" +In SQL Management Studio +Right-click on the instance +>> Select "Properties" +>> Select "Security" on the left hand side +>> Select "Both failed and successful logins" +>> Click "OK"Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' + +If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. + +If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. + +In SQL Management Studio +Right-click on the instance +>> Select "Properties" +>> Select "Security" on the left hand side +>> Check the setting for "Login auditing" + +If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000503-DB-000351<GroupDescription></GroupDescription>SQL6-D0-014800SQL Server must generate audit records when unsuccessful logons or connection attempts occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93995V-79289CCI-000172Add the "FAILED_LOGIN_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (FAILED_LOGIN_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "FAILED_LOGIN_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' + +If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000504-DB-000354<GroupDescription></GroupDescription>SQL6-D0-014900SQL Server must generate audit records for all privileged activities or other system-level access.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +System documentation should include a definition of the functionality considered privileged. + +A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples in SQL include: + +TRUNCATE TABLE; +DELETE, or +DELETE affecting more than n rows, for some n, or +DELETE without a WHERE clause; + +UPDATE or +UPDATE affecting more than n rows, for some n, or +UPDATE without a WHERE clause; + +any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. + +Depending on the capabilities of SQL Server and the design of the database and associated applications, audit logging may be achieved by means of DBMS auditing features, database triggers, other mechanisms, or a combination of these. + +Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93997V-79291CCI-000172Add the required events to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP +LOGIN_CHANGE_PASSWORD_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') + +If the identified groups are not returned, this is a finding.SRG-APP-000504-DB-000355<GroupDescription></GroupDescription>SQL6-D0-015000SQL Server must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +System documentation should include a definition of the functionality considered privileged. + +A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93999V-79293CCI-000172Add the required events to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP -LOGOUT_GROUP -SCHEMA_OBJECT_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OPERATION_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_PRINCIPAL_CHANGE_GROUP -SERVER_PRINCIPAL_IMPERSONATION_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP -SERVER_STATE_CHANGE_GROUP -TRACE_CHANGE_GROUP -USER_CHANGE_PASSWORD_GROUP - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 +LOGOUT_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', @@ -3039,69 +3039,69 @@ Order by d.audit_action_name If the identified groups are not returned, this is a finding. -SRG-APP-000505-DB-000352<GroupDescription></GroupDescription>SQL6-D0-015100SQL Server must generate audit records showing starting and ending time for user access to the database(s).<VulnDiscussion>For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. - -Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94001V-79295CCI-000172Add the "LOGOUT_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the following events are included in the server audit specification: - -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP -AUDIT_CHANGE_GROUP -BACKUP_RESTORE_GROUP -DATABASE_CHANGE_GROUP -DATABASE_OBJECT_CHANGE_GROUP -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OPERATION_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_PRINCIPAL_CHANGE_GROUP -DATABASE_PRINCIPAL_IMPERSONATION_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -DBCC_GROUP +SRG-APP-000505-DB-000352<GroupDescription></GroupDescription>SQL6-D0-015100SQL Server must generate audit records showing starting and ending time for user access to the database(s).<VulnDiscussion>For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. + +Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94001V-79295CCI-000172Add the "LOGOUT_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP -LOGOUT_GROUP -SCHEMA_OBJECT_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OPERATION_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_PRINCIPAL_CHANGE_GROUP -SERVER_PRINCIPAL_IMPERSONATION_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP -SERVER_STATE_CHANGE_GROUP -TRACE_CHANGE_GROUP -USER_CHANGE_PASSWORD_GROUP - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 +LOGOUT_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', @@ -3138,250 +3138,250 @@ Order by d.audit_action_name If the identified groups are not returned, this is a finding. -SRG-APP-000506-DB-000353<GroupDescription></GroupDescription>SQL6-D0-015200SQL Server must generate audit records when concurrent logons/connections by the same user from different workstations occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. - -Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised. - -(If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94003V-79297CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO - -Alternatively, enable "Both failed and successful logins" -In SQL Management Studio: -Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Select "Both failed and successful logins" >> Click "OK"Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the "SUCCESSFUL_LOGIN_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' - -If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. - -If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. - -In SQL Management Studio: -Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" - -If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000507-DB-000356<GroupDescription></GroupDescription>SQL6-D0-015300SQL Server must generate audit records when successful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94005V-79299CCI-000172Deploy an audit to audit when successful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when successful accesses to objects occur. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000507-DB-000357<GroupDescription></GroupDescription>SQL6-D0-015400SQL Server must generate audit records when unsuccessful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94007V-79301CCI-000172Deploy an audit to audit when unsuccessful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when unsuccessful accesses to objects occur. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000508-DB-000358<GroupDescription></GroupDescription>SQL6-D0-015500SQL Server must generate audit records for all direct access to the database(s).<VulnDiscussion>In this context, direct access is any query, command, or call to SQL Server that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and non-standard sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94009V-79303CCI-000172Check the system documentation for required SQL Server Audits. Remove any Audit filters that exclude or reduce required auditing. Update filters to ensure administrative activity is not excluded.Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: - -SELECT name AS AuditName, predicate AS AuditFilter -FROM sys.server_audits -WHERE predicate IS NOT NULL - -If any audits are returned, review the associated filters to determine whether administrative activities are being excluded. - -If any audits are configured to exclude administrative activities, this is a finding.SRG-APP-000514-DB-000381<GroupDescription></GroupDescription>SQL6-D0-015600SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. - -For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94011V-79305CCI-002450In Windows, open Administrative Tools >> Local Security Policy. - -Expand Local Policies >> Security Options. - -In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing."Verify that Windows is configured to require the use of FIPS compliant algorithms. - -Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -If the Security Setting for this option is "Disabled" this is a finding.SRG-APP-000514-DB-000382<GroupDescription></GroupDescription>SQL6-D0-015700SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. - -For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94013V-79307CCI-002450Configure Windows to require the use of FIPS compliant algorithms. - +SRG-APP-000506-DB-000353<GroupDescription></GroupDescription>SQL6-D0-015200SQL Server must generate audit records when concurrent logons/connections by the same user from different workstations occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. + +Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised. + +(If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94003V-79297CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +Alternatively, enable "Both failed and successful logins" +In SQL Management Studio: +Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Select "Both failed and successful logins" >> Click "OK"Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SUCCESSFUL_LOGIN_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' + +If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. + +If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. + +In SQL Management Studio: +Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" + +If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000507-DB-000356<GroupDescription></GroupDescription>SQL6-D0-015300SQL Server must generate audit records when successful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94005V-79299CCI-000172Deploy an audit to audit when successful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when successful accesses to objects occur. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000507-DB-000357<GroupDescription></GroupDescription>SQL6-D0-015400SQL Server must generate audit records when unsuccessful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94007V-79301CCI-000172Deploy an audit to audit when unsuccessful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when unsuccessful accesses to objects occur. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000508-DB-000358<GroupDescription></GroupDescription>SQL6-D0-015500SQL Server must generate audit records for all direct access to the database(s).<VulnDiscussion>In this context, direct access is any query, command, or call to SQL Server that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and non-standard sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94009V-79303CCI-000172Check the system documentation for required SQL Server Audits. Remove any Audit filters that exclude or reduce required auditing. Update filters to ensure administrative activity is not excluded.Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: + +SELECT name AS AuditName, predicate AS AuditFilter +FROM sys.server_audits +WHERE predicate IS NOT NULL + +If any audits are returned, review the associated filters to determine whether administrative activities are being excluded. + +If any audits are configured to exclude administrative activities, this is a finding.SRG-APP-000514-DB-000381<GroupDescription></GroupDescription>SQL6-D0-015600SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94011V-79305CCI-002450In Windows, open Administrative Tools >> Local Security Policy. + +Expand Local Policies >> Security Options. + +In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing."Verify that Windows is configured to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If the Security Setting for this option is "Disabled" this is a finding.SRG-APP-000514-DB-000382<GroupDescription></GroupDescription>SQL6-D0-015700SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94013V-79307CCI-002450Configure Windows to require the use of FIPS compliant algorithms. + Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsVerify that Windows is configured to require the use of FIPS 140-2 algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." -If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000514-DB-000383<GroupDescription></GroupDescription>SQL6-D0-015800SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. - -It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. - -For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94015V-79309CCI-002450Configure Windows to require the use of FIPS compliant algorithms for the unclassified information that requires it. - +If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000514-DB-000383<GroupDescription></GroupDescription>SQL6-D0-015800SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94015V-79309CCI-002450Configure Windows to require the use of FIPS compliant algorithms for the unclassified information that requires it. + Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsReview the server documentation, if this system does not contain data that must be encrypted, this finding is NA. Verify that Windows is configured to require the use of FIPS 140-2 algorithms for the unclassified information that requires it. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." -If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000515-DB-000318<GroupDescription></GroupDescription>SQL6-D0-015900The system SQL Server must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. - -Off-loading is a common process in information systems with limited audit storage capacity. - -The system SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94017V-79311CCI-001851Configure the system or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.Review the system documentation for a description of how audit records are off-loaded. - -If the system has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. - -If the system does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016000SQL Server must configure Customer Feedback and Error Reporting.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94019V-79313CCI-000366To disable participation in the CEIP program, change the value of the following registry keys to zero (0). - -To enable participation in the CEIP program, change the value of the following registry keys to one (1). - -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\CustomerFeedback -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\EnableErrorReporting -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\CustomerFeedback -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\EnableErrorReportingLaunch "Registry Editor" - -Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE -Review the following values: CustomerFeedback, EnableErrorReporting - -Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130 -Review the following values: CustomerFeedback, EnableErrorReporting - -If this is a classified system, and any of the above values are not zero (0), this is a finding. - -If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized. - -If CEIP participation is not authorized, and any of the above values are one (1), this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016100SQL Server must configure SQL Server Usage and Error Reporting Auditing.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs. The Local Audit component of SQL Server Usage Feedback collection writes data collected by the service to a designated folder, representing the data (logs) that will be sent to Microsoft. The purpose of the Local Audit is to allow customers to see all data Microsoft collects with this feature, for compliance, regulatory or privacy validation reasons.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94021V-79315CCI-000366Configure the instance to audit telemetry data. More information about auditing telemetry data can be found at https://msdn.microsoft.com/en-us/library/mt743085.aspx. - -Create a folder to store the telemetry audit data in. - -Grant the SQLTELEMETRY service the following permissions on the folder: - -- List folder contents -- Read -- Write - -Create and configure the following registry key: -Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) - -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory [string] - -Set the "UserRequestedLocalAuditDirectory" key value to the path of the telemetry audit folder. - -Set the telemetry service to start automatically. Restart the service. -- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). -- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>).Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. - -If auditing of telemetry data is required, determine the telemetry service user name by executing the following query: - -SELECT name -FROM sys.server_principals -WHERE name LIKE '%SQLTELEMETRY%' - -Review the values of the following registry key: -Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) - -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory - -If the registry key do not exist or the value is blank, this is a finding. - -Navigate the path defined in the "UserRequestedLocalAuditDirectory" registry key in file explorer. - -Right-click on the folder and choose "Properties". +If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000515-DB-000318<GroupDescription></GroupDescription>SQL6-D0-015900The system SQL Server must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. + +Off-loading is a common process in information systems with limited audit storage capacity. + +The system SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94017V-79311CCI-001851Configure the system or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.Review the system documentation for a description of how audit records are off-loaded. + +If the system has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. + +If the system does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016000SQL Server must configure Customer Feedback and Error Reporting.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94019V-79313CCI-000366To disable participation in the CEIP program, change the value of the following registry keys to zero (0). + +To enable participation in the CEIP program, change the value of the following registry keys to one (1). + +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\CustomerFeedback +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\EnableErrorReporting +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\CustomerFeedback +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\EnableErrorReportingLaunch "Registry Editor" + +Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE +Review the following values: CustomerFeedback, EnableErrorReporting + +Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130 +Review the following values: CustomerFeedback, EnableErrorReporting + +If this is a classified system, and any of the above values are not zero (0), this is a finding. + +If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized. + +If CEIP participation is not authorized, and any of the above values are one (1), this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016100SQL Server must configure SQL Server Usage and Error Reporting Auditing.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs. The Local Audit component of SQL Server Usage Feedback collection writes data collected by the service to a designated folder, representing the data (logs) that will be sent to Microsoft. The purpose of the Local Audit is to allow customers to see all data Microsoft collects with this feature, for compliance, regulatory or privacy validation reasons.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94021V-79315CCI-000366Configure the instance to audit telemetry data. More information about auditing telemetry data can be found at https://msdn.microsoft.com/en-us/library/mt743085.aspx. + +Create a folder to store the telemetry audit data in. + +Grant the SQLTELEMETRY service the following permissions on the folder: + +- List folder contents +- Read +- Write + +Create and configure the following registry key: +Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory [string] + +Set the "UserRequestedLocalAuditDirectory" key value to the path of the telemetry audit folder. + +Set the telemetry service to start automatically. Restart the service. +- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). +- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>).Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. + +If auditing of telemetry data is required, determine the telemetry service user name by executing the following query: + +SELECT name +FROM sys.server_principals +WHERE name LIKE '%SQLTELEMETRY%' + +Review the values of the following registry key: +Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory + +If the registry key do not exist or the value is blank, this is a finding. + +Navigate the path defined in the "UserRequestedLocalAuditDirectory" registry key in file explorer. + +Right-click on the folder and choose "Properties". Open the "Security" tab. - -Verify the SQLTELEMETRY account has the following permissions: - -- List folder contents -- Read -- Write - -If the permissions are not set properly on the folder, this is a finding. - -Open services.msc and find the telemetry service. -- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). -- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>). - -Right-click on the service and choose "Properties". Verify the "Startup type" is "Automatic." - -If the service is not configured to automatically start, this is a finding. - -Review the processes and procedures for reviewing the telemetry data. If there is evidence that the telemetry data is periodically reviewed in accordance with the processes and procedures, this is not a finding. - -If no processes and procedures exist for reviewing telemetry data, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-016200The SQL Server default account [sa] must be disabled.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. - -This [sa] default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server. If the [sa] default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the [sa] account. + +Verify the SQLTELEMETRY account has the following permissions: + +- List folder contents +- Read +- Write + +If the permissions are not set properly on the folder, this is a finding. + +Open services.msc and find the telemetry service. +- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). +- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>). + +Right-click on the service and choose "Properties". Verify the "Startup type" is "Automatic." + +If the service is not configured to automatically start, this is a finding. + +Review the processes and procedures for reviewing the telemetry data. If there is evidence that the telemetry data is periodically reviewed in accordance with the processes and procedures, this is not a finding. + +If no processes and procedures exist for reviewing telemetry data, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-016200The SQL Server default account [sa] must be disabled.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. + +This [sa] default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server. If the [sa] default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the [sa] account. Some applications that run on SQL Server require the [sa] account to be enabled in order for the application to function properly. These applications that require the [sa] account to be enabled are usually legacy systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94023V-79317CCI-000213Modify the enabled flag of SQL Server's [sa] (system administrator) account by running the following script. -USE master; -GO -ALTER LOGIN [sa] DISABLE; +USE master; +GO +ALTER LOGIN [sa] DISABLE; GOCheck SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: USE master; @@ -3393,21 +3393,21 @@ GO Verify that the "name" column contains the current name of the [sa] database server account. -If the "is_disabled" column is not set to “1”, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-016300SQL Server default account [sa] must have its name changed.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. +If the "is_disabled" column is not set to “1”, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-016300SQL Server default account [sa] must have its name changed.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. Since the SQL Server [sa] is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the [sa] account name.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94025V-79319CCI-000381Modify the SQL Server's [sa] (system administrator) account by running the following script: -USE master; -GO -ALTER LOGIN [sa] WITH NAME = <new name> -GOVerify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: +USE master; +GO +ALTER LOGIN [sa] WITH NAME = <new name> +GOVerify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: -USE master; -GO -SELECT * -FROM sys.sql_logins -WHERE [name] = 'sa' OR [principal_id] = 1; -GO +USE master; +GO +SELECT * +FROM sys.sql_logins +WHERE [name] = 'sa' OR [principal_id] = 1; +GO If the login account name "SA" or "sa" appears in the query output, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-016400Execution of startup stored procedures must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. @@ -3421,7 +3421,7 @@ Where OBJECTPROPERTY(OBJECT_ID, 'ExecIsStartup') = 1 If any stored procedures are returned that are not documented, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016500SQL Server Mirroring endpoint must utilize AES encryption.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. SQL Mirroring endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94029V-79323CCI-000366Run the following to enable encryption on the mirroring endpoint: @@ -3437,7 +3437,7 @@ WHERE encryption_algorithm != 2 If any records are returned, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016600SQL Server Service Broker endpoint must utilize AES encryption.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. SQL Server Service Broker endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94031V-79325CCI-000366Run the following to enable encryption on the Service Broker endpoint: @@ -3451,9 +3451,9 @@ SELECT name, type_desc, encryption_algorithm_desc FROM sys.service_broker_endpoints WHERE encryption_algorithm != 2 -If any records are returned, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016700SQL Server execute permissions to access the registry must be revoked, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If any records are returned, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016700SQL Server execute permissions to access the registry must be revoked, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3490,9 +3490,9 @@ WHERE major_id IN ( AND dp.[type] = 'EX' ORDER BY dpr.NAME; -If any records are returned, review the system documentation to determine whether the accessing of the registry via extended stored procedures are required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016800Filestream must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If any records are returned, review the system documentation to determine whether the accessing of the registry via extended stored procedures are required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016800Filestream must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3503,9 +3503,9 @@ The most significant potential for attacking an instance is through the use of f 3. Remove all FILESTREAM data containers. ALTER DATABASE <name> REMOVE FILE <file name> 4. Remove all FILESTREAM filegroups. ALTER DATABASE <name> REMOVE FILEGROUP <file name>. 5. Disable FILESTREAM. -EXEC sp_configure filestream_access_level, 0 - RECONFIGURE -6. Restart the SQL ServiceReview the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. +EXEC sp_configure filestream_access_level, 0 + RECONFIGURE +6. Restart the SQL ServiceReview the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. If FileStream is not documented as being authorized, execute the following query. EXEC sp_configure 'filestream access level' @@ -3516,17 +3516,17 @@ If "run_value" is greater than "0", this is a finding. This rule checks that Filestream SQL specific option is disabled. -SELECT CASE - WHEN EXISTS (SELECT * - FROM sys.configurations - WHERE Name = 'filestream access level' - AND Cast(value AS INT) = 0) THEN 'No' +SELECT CASE + WHEN EXISTS (SELECT * + FROM sys.configurations + WHERE Name = 'filestream access level' + AND Cast(value AS INT) = 0) THEN 'No' ELSE 'Yes' END AS TSQLFileStreamAccess; -If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017000Ole Automation Procedures feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017000Ole Automation Procedures feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3538,43 +3538,43 @@ The Ole Automation Procedures option controls whether OLE Automation objects can The Ole Automation Procedures extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94039V-79333CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Ole Automation Procedures" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'Ole Automation Procedures', 0; -GO -RECONFIGURE; -GOTo determine if "Ole Automation Procedures" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'Ole Automation Procedures', 0; +GO +RECONFIGURE; +GOTo determine if "Ole Automation Procedures" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'Ole Automation Procedures'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'Ole Automation Procedures'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017100SQL Server User Options feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94041V-79335CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "User Options" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'user options', 0; -GO -RECONFIGURE; +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'user options', 0; +GO +RECONFIGURE; GOTo determine if "User Options" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'user options'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'user options'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017200Remote Access feature must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017200Remote Access feature must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3584,24 +3584,24 @@ SQL Server is capable of providing a wide range of features and services. Some o The Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server.  'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94043V-79337CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Access" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'remote access', 0; -GO -RECONFIGURE; -GOTo determine if "Remote Access" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'remote access', 0; +GO +RECONFIGURE; +GOTo determine if "Remote Access" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'remote access'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'remote access'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017400Hadoop Connectivity feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017400Hadoop Connectivity feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3611,24 +3611,24 @@ SQL Server is capable of providing a wide range of features and services. Some o The Hadoop Connectivity feature allows multiple types of external data sources to be created and used across all sessions on the server.  An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94047V-79341CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Hadoop Connectivity" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'hadoop connectivity', 0; -GO -RECONFIGURE; -GOTo determine if "Hadoop Connectivity" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'hadoop connectivity', 0; +GO +RECONFIGURE; +GOTo determine if "Hadoop Connectivity" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'hadoop connectivity'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'hadoop connectivity'; If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017500Allow Polybase Export feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017500Allow Polybase Export feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3638,24 +3638,24 @@ SQL Server is capable of providing a wide range of features and services. Some o The Allow Polybase Export feature allows an export of data to an external data source such as Hadoop File System or Azure Data Lake. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94049V-79343CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Allow Polybase Export" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'allow polybase export', 0; -GO -RECONFIGURE; -GOTo determine if "Allow Polybase Export" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'allow polybase export', 0; +GO +RECONFIGURE; +GOTo determine if "Allow Polybase Export" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'allow polybase export'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'allow polybase export'; If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017600Remote Data Archive feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017600Remote Data Archive feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3665,94 +3665,94 @@ SQL Server is capable of providing a wide range of features and services. Some o The Remote Data Archive feature allows an export of local SQL Server data to an Azure SQL Database. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94051V-79345CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Data Archive" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'remote data archive', 0; -GO -RECONFIGURE; -GOTo determine if "Remote Data Archive" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'remote data archive', 0; +GO +RECONFIGURE; +GOTo determine if "Remote Data Archive" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'remote data archive'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'remote data archive'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017700SQL Server External Scripts Enabled feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. The External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94053V-79347CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "External Scripts Enabled" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'external scripts enabled', 0; -GO -RECONFIGURE; -GOTo determine if "External Scripts Enabled" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'external scripts enabled', 0; +GO +RECONFIGURE; +GOTo determine if "External Scripts Enabled" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'external scripts enabled'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'external scripts enabled'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-017800The SQL Server Browser service must be disabled unless specifically required and approved.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. -This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. +This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. -This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94055V-79349CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. +This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94055V-79349CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. -Where SQL Server Browser is judged unnecessary, the Service can be disabled. +Where SQL Server Browser is judged unnecessary, the Service can be disabled. -To disable, in the Services tool, double-click "SQL Server Browser". Set "Startup Type" to "Disabled". If "Service Status" is "Running", click on "Stop". Click on "OK".If the need for the SQL Server Browser service is documented and authorized, this is not a finding. +To disable, in the Services tool, double-click "SQL Server Browser". Set "Startup Type" to "Disabled". If "Service Status" is "Running", click on "Stop". Click on "OK".If the need for the SQL Server Browser service is documented and authorized, this is not a finding. -Open the Services tool. +Open the Services tool. -Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services"; or at a command prompt, type "services.msc" and press the "Enter" key. +Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services"; or at a command prompt, type "services.msc" and press the "Enter" key. -Scroll to "SQL Server Browser". +Scroll to "SQL Server Browser". If its Startup Type is not shown as "Disabled", this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017900SQL Server Replication Xps feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. Enabling the replication XPs opens a significant attack surface area that can be used by an attacker to gather information about the system and potentially abuse the privileges of SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94057V-79351CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Replication Xps" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'replication xps', 0; -GO -RECONFIGURE; -GOTo determine if the "Replication Xps" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'replication xps', 0; +GO +RECONFIGURE; +GOTo determine if the "Replication Xps" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'replication xps'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'replication xps'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-018000If the SQL Server Browser Service is specifically required and approved, SQL instances must be hidden.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. -This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. +This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. -This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances. In order to prevent this, the SQL instance(s) can be hidden.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94059V-79353CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. +This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances. In order to prevent this, the SQL instance(s) can be hidden.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94059V-79353CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. -To hide the SQL instance, in SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, select "Properties", on the "Flags" tab, select "Yes" in the "HideInstance" box, then click "OK".  The change takes effect immediately for new connections.If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances that do not require use of the SQL Browser Service are hidden with the following query: +To hide the SQL instance, in SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, select "Properties", on the "Flags" tab, select "Yes" in the "HideInstance" box, then click "OK".  The change takes effect immediately for new connections.If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances that do not require use of the SQL Browser Service are hidden with the following query: -DECLARE @HiddenInstance INT -EXEC master.dbo.Xp_instance_regread - N'HKEY_LOCAL_MACHINE', - N'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', - N'HideInstance', - @HiddenInstance output +DECLARE @HiddenInstance INT +EXEC master.dbo.Xp_instance_regread + N'HKEY_LOCAL_MACHINE', + N'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', + N'HideInstance', + @HiddenInstance output -SELECT CASE - WHEN @HiddenInstance = 0 - AND Serverproperty('IsClustered') = 0 THEN 'No' - ELSE 'Yes' +SELECT CASE + WHEN @HiddenInstance = 0 + AND Serverproperty('IsClustered') = 0 THEN 'No' + ELSE 'Yes' END AS [Hidden] If the value of "Hidden" is "Yes", this is not a finding. @@ -3774,7 +3774,7 @@ GO If mixed-mode authentication is necessary, then for SQLCMD, which cannot be configured not to accept a plain-text password when mixed-mode authentication is enabled, and any other essential tool with the same limitation: 1) Document the need for it, who uses it, and any relevant mitigations, and obtain AO approval. 2) Train all users of the tool in the importance of not using the plain-text password option and in how to keep the password hidden.Run this query to determine whether SQL Server authentication is enabled: -EXEC master.sys.xp_loginconfig 'login mode'; +EXEC master.sys.xp_loginconfig 'login mode'; If the config_value returned is "Windows NT Authentication", this is not a finding. @@ -3788,4 +3788,4 @@ For example, displaying asterisks when a user types in a password or PIN, is an Database applications may allow for entry of the account name and password as a visible parameter of the application execution command. This practice must be prohibited and disabled to prevent shoulder surfing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94063V-79357CCI-000206Configure or modify applications to prohibit display of passwords in clear text.Determine whether any applications that access the database allow for entry of the account name and password, or PIN. -If any do, determine whether these applications obfuscate authentication data; if they do not, this is a finding. +If any do, determine whether these applications obfuscate authentication data; if they do not, this is a finding. \ No newline at end of file diff --git a/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R1_Manual-xccdf.log b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R3_Manual-xccdf.log similarity index 100% rename from source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R1_Manual-xccdf.log rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R3_Manual-xccdf.log diff --git a/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R1_Manual-xccdf.xml b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R3_Manual-xccdf.xml similarity index 82% rename from source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R1_Manual-xccdf.xml rename to source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R3_Manual-xccdf.xml index 0084b651a..1aeb88fde 100644 --- a/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R1_Manual-xccdf.xml +++ b/source/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V2R3_Manual-xccdf.xml @@ -1,205 +1,205 @@ -acceptedMS SQL Server 2016 Instance Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 23 Oct 20203.1.1.362251.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000001-DB-000031<GroupDescription></GroupDescription>SQL6-D0-003600SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.<VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. - -This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts; and it does not deal with the total number of sessions across all accounts. - -The capability to limit the number of concurrent sessions per user must be configured in or added to SQL Server (for example, by use of a logon trigger), when this is technically feasible. Note that it is not sufficient to limit sessions via a web server or application server alone, because legitimate users and adversaries can potentially connect to SQL Server by other means. - -The organization will need to define the maximum number of concurrent sessions by account type, by account, or a combination thereof. In deciding on the appropriate number, it is important to consider the work requirements of the various types of users. For example, 2 might be an acceptable limit for general users accessing the database via an application; but 10 might be too few for a database administrator using a database management GUI tool, where each query tab and navigation pane may count as a separate session. - -(Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93825V-79119CCI-000054Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users. - -CREATE TRIGGER SQL_STIG_Connection_Limit -ON ALL SERVER WITH EXECUTE AS 'sa' --Make sure to use the renamed SA account here. -FOR LOGON -AS -BEGIN - IF (SELECT COUNT(1) - FROM sys.dm_exec_sessions - WHERE is_user_process = 1 - And original_login_name = ORIGINAL_LOGIN() - ) > 1000 --Organizationally defined number - BEGIN - PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded the concurrent session limit.' - ROLLBACK; - END -END; - -Reference: https://msdn.microsoft.com/en-us/library/ms189799.aspxReview the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. - -If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. - -Otherwise, determine if a logon trigger exists: - -In SQL Server Management Studio's Object Explorer tree: -Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers - -OR - -Run the query: -SELECT name FROM master.sys.server_triggers; - -If no triggers are listed, this is a finding. - -If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. - -Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. - -Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003700SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. - -A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. - -Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. - -SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. - -Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79121SV-93827CCI-000015If mixed mode is required, document the need and justification; describe the measures taken to ensure the use of SQL Server authentication is kept to a minimum; describe the measures taken to safeguard passwords; list or describe the SQL Logins used. - -Risk must be accepted by the ISSO/ISSM. - -If mixed mode is not required, disable it as follows: - -In the SSMS Object Explorer, right-click on the server instance. -Select "Properties". -Select the Security page. -Click on the radio button for "Windows Authentication Mode". -Click on "OK". -Restart the SQL Server instance. - -OR - -Run the statement: -USE [master] -EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2 -GO - -Restart the SQL Server instance. - -For each account being managed by SQL Server but not requiring it, drop or disable the SQL Login. Replace it with an appropriately configured account, as needed. - -To drop or disable a Login in the SSMS Object Explorer: -Navigate to "Security Logins". -Right-click on the Login name; click on "Delete" or "Disable". - -To drop or disable a Login by using a query: -USE master; -DROP LOGIN login_name; -ALTER LOGIN login_name DISABLE; - -Dropping a Login does not delete the equivalent database User(s). There may be more than one database containing a User mapped to the Login. Drop the User(s) unless still needed. - -To drop a User in the SSMS Object Explorer: -Navigate to Databases >> Security Users. -Right-click on the User name. -Click "Delete". - -To drop a User via a query: -USE database_name; -DROP USER <user_name>;Determine whether SQL Server is configured to use only Windows authentication. - -In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. -Select "Properties". -Select the Security page. - -If Windows Authentication Mode is selected, this is not a finding. - -OR - -In a query interface such as the SSMS Transact-SQL editor, run the statement: -SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') -WHEN 1 THEN 'Windows Authentication' -WHEN 0 THEN 'Windows and SQL Server Authentication' -END as [Authentication Mode] - -If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. - -Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved, this is a finding. - -From the documentation, obtain the list of accounts authorized to be managed by SQL Server. - -Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement: - -SELECT name -FROM sys.sql_logins -WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0; - -If any accounts listed by the query are not listed in the documentation, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003800SQL Server must be configured to utilize the most-secure authentication method available.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. - -A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. - -Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. - -SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. - -Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements. - -SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79123SV-93829CCI-000015Ensure Service Principal Names (SPNs) are properly registered for the SQL Server instance. - -Utilize the Microsoft Kerberos Configuration Manager to review Kerberos configuration issues for a given SQL Server instance. - -https://www.microsoft.com/en-us/download/details.aspx?id=39046 - -Alternatively, SPNs for SQL Server can be manually registered. +acceptedMS SQL Server 2016 Instance Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 3 Benchmark Date: 23 Apr 20213.2.2.360791.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000001-DB-000031<GroupDescription></GroupDescription>SQL6-D0-003600SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.<VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. + +This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts; and it does not deal with the total number of sessions across all accounts. + +The capability to limit the number of concurrent sessions per user must be configured in or added to SQL Server (for example, by use of a logon trigger), when this is technically feasible. Note that it is not sufficient to limit sessions via a web server or application server alone, because legitimate users and adversaries can potentially connect to SQL Server by other means. + +The organization will need to define the maximum number of concurrent sessions by account type, by account, or a combination thereof. In deciding on the appropriate number, it is important to consider the work requirements of the various types of users. For example, 2 might be an acceptable limit for general users accessing the database via an application; but 10 might be too few for a database administrator using a database management GUI tool, where each query tab and navigation pane may count as a separate session. + +(Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93825V-79119CCI-000054Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users. + +CREATE TRIGGER SQL_STIG_Connection_Limit +ON ALL SERVER WITH EXECUTE AS 'sa' --Make sure to use the renamed SA account here. +FOR LOGON +AS +BEGIN + IF (SELECT COUNT(1) + FROM sys.dm_exec_sessions + WHERE is_user_process = 1 + And original_login_name = ORIGINAL_LOGIN() + ) > 1000 --Organizationally defined number + BEGIN + PRINT 'The login [' + ORIGINAL_LOGIN() + '] has exceeded the concurrent session limit.' + ROLLBACK; + END +END; + +Reference: https://msdn.microsoft.com/en-us/library/ms189799.aspxReview the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. + +If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. + +Otherwise, determine if a logon trigger exists: + +In SQL Server Management Studio's Object Explorer tree: +Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers + +OR + +Run the query: +SELECT name FROM master.sys.server_triggers; + +If no triggers are listed, this is a finding. + +If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. + +Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. + +Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003700SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. + +A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. + +Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. + +SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. + +Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93827V-79121CCI-000015If mixed mode is required, document the need and justification; describe the measures taken to ensure the use of SQL Server authentication is kept to a minimum; describe the measures taken to safeguard passwords; list or describe the SQL Logins used. + +Risk must be accepted by the ISSO/ISSM. + +If mixed mode is not required, disable it as follows: + +In the SSMS Object Explorer, right-click on the server instance. +Select "Properties". +Select the Security page. +Click on the radio button for "Windows Authentication Mode". +Click on "OK". +Restart the SQL Server instance. + +OR + +Run the statement: +USE [master] +EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 2 +GO + +Restart the SQL Server instance. + +For each account being managed by SQL Server but not requiring it, drop or disable the SQL Login. Replace it with an appropriately configured account, as needed. + +To drop or disable a Login in the SSMS Object Explorer: +Navigate to "Security Logins". +Right-click on the Login name; click on "Delete" or "Disable". + +To drop or disable a Login by using a query: +USE master; +DROP LOGIN login_name; +ALTER LOGIN login_name DISABLE; + +Dropping a Login does not delete the equivalent database User(s). There may be more than one database containing a User mapped to the Login. Drop the User(s) unless still needed. + +To drop a User in the SSMS Object Explorer: +Navigate to Databases >> Security Users. +Right-click on the User name. +Click "Delete". + +To drop a User via a query: +USE database_name; +DROP USER <user_name>;Determine whether SQL Server is configured to use only Windows authentication. + +In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. +Select "Properties". +Select the Security page. + +If Windows Authentication Mode is selected, this is not a finding. + +OR + +In a query interface such as the SSMS Transact-SQL editor, run the statement: +SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') +WHEN 1 THEN 'Windows Authentication' +WHEN 0 THEN 'Windows and SQL Server Authentication' +END as [Authentication Mode] + +If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. + +Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved, this is a finding. + +From the documentation, obtain the list of accounts authorized to be managed by SQL Server. + +Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement: + +SELECT name +FROM sys.sql_logins +WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0; + +If any accounts listed by the query are not listed in the documentation, this is a finding.SRG-APP-000023-DB-000001<GroupDescription></GroupDescription>SQL6-D0-003800SQL Server must be configured to utilize the most-secure authentication method available.<VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. + +A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. + +Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. + +SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. + +Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements. + +SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93829V-79123CCI-000015Ensure Service Principal Names (SPNs) are properly registered for the SQL Server instance. + +Utilize the Microsoft Kerberos Configuration Manager to review Kerberos configuration issues for a given SQL Server instance. + +https://www.microsoft.com/en-us/download/details.aspx?id=39046 + +Alternatively, SPNs for SQL Server can be manually registered. For other connections that support Kerberos the SPN is registered in the format MSSQLSvc/<FQDN>/<instancename> for a named instance. The format for registering the default instance is MSSQLSvc/<FQDN>. -Using an account with permissions to register SPNs, issue the following commands from a command-prompt: +Using an account with permissions to register SPNs, issue the following commands from a command-prompt: -setspn -S MSSQLSvc/<Fully Qualified Domain Name> <Service Account> -setspn -S MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> <Service Account> +setspn -S MSSQLSvc/<Fully Qualified Domain Name> <Service Account> +setspn -S MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> <Service Account> For a named instance, use: -setspn -S MSSQLSvc/<FQDN>/<instancename> <Service Account> +setspn -S MSSQLSvc/<FQDN>/<instancename> <Service Account> setspn -S MSSQLSvc/<FQDN>/<instancename>:<TCP Port> <Service Account> -Restart the SQL Server instance. +Restart the SQL Server instance. -More information regarding this process is available at: -https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections#ManualIf the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. +More information regarding this process is available at: +https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections#ManualIf the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. -Obtain the fully qualified domain name of the SQL Server instance: +Obtain the fully qualified domain name of the SQL Server instance: -Launch Windows Explorer. +Launch Windows Explorer. -Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". +Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". -Note the value shown for "Full computer name". +Note the value shown for "Full computer name". -*** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** +*** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** -Obtain the TCP port that is supporting the SQL Server instance: +Obtain the TCP port that is supporting the SQL Server instance: -Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". +Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". -From the tree on the left, expand "SQL Server Network Configuration". +From the tree on the left, expand "SQL Server Network Configuration". -Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). +Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). -In the right pane, right-click on "TCP/IP" and choose "Properties". +In the right pane, right-click on "TCP/IP" and choose "Properties". -In the window that opens, click the "IP Addresses" tab. +In the window that opens, click the "IP Addresses" tab. -Note the TCP port configured for the instance. +Note the TCP port configured for the instance. -Obtain the service account that is running the SQL Server service: +Obtain the service account that is running the SQL Server service: -Click "Start". -Type "SQL Server 2016 Configuration Manager". -From the search results, click "SQL Server 2016 Configuration Manager". +Click "Start". +Type "SQL Server 2016 Configuration Manager". +From the search results, click "SQL Server 2016 Configuration Manager". -From the tree on the left, select "SQL Server Services". +From the tree on the left, select "SQL Server Services". -Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. +Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. -Launch a command-line or PowerShell window. +Launch a command-line or PowerShell window. -Enter the following command where <Service Account> is the identity of the service account. +Enter the following command where <Service Account> is the identity of the service account. -setspn -L <Service Account> +setspn -L <Service Account> -Example: setspn -L CONTOSO\sql2016svc +Example: setspn -L CONTOSO\sql2016svc -Review the Registered Service Principal Names returned. +Review the Registered Service Principal Names returned. -If the listing does not contain the following supported service principal names (SPN) formats, this is a finding. +If the listing does not contain the following supported service principal names (SPN) formats, this is a finding. Named instance MSSQLSvc/<FQDN>:[<port> | <instancename>], where: @@ -214,53 +214,53 @@ Default instance <FQDN> is the fully qualified domain name of the server. <port> is the TCP port number. -If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-003900SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.<VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies. - -Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. - -Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. - -This requirement is applicable to access control enforcement applications, a category that includes database management systems. If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79125SV-93831CCI-000213Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them into line with the documented requirements.Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. - -Review the permissions actually in place on the server. - -If the actual permissions do not match the documented requirements, this is a finding. - -Use the supplemental file "Instance permissions assignments to logins and roles.sql."SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004000SQL Server must protect against a user falsely repudiating by ensuring all accounts are individual, unique, and not shared.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. - -In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79127SV-93833CCI-000166Remove user-accessible shared accounts and use individual user IDs. - -Build/configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances. - -Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.Obtain the list of authorized SQL Server accounts in the system documentation. - -Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. - -If accounts are determined to be shared, determine if individuals are first individually authenticated. - -If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. - -The key is individual accountability. If this can be traced, this is not a finding. - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. - -Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. - -If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. - -Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004100SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. - -In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. - -Any user with enough access to the server can execute a task that will be run as NT AUTHORITY\SYSTEM either using task scheduler or other tools. At this point, NT AUTHORITY\SYSTEM essentially becomes a shared account because the operating system and SQL Server are unable to determine who created the process. - -Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role by default. This allowed jobs/tasks to be executed in SQL Server without the approval or knowledge of the DBA because it looked like operating system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79129SV-93835CCI-000166Remove permissions that were identified as not allowed in the check content. +If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-003900SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.<VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies. + +Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. + +Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. + +This requirement is applicable to access control enforcement applications, a category that includes database management systems. If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93831V-79125CCI-000213Use GRANT, REVOKE, DENY, ALTER SERVER ROLE … ADD MEMBER … and/or ALTER SERVER ROLE …. DROP MEMBER statements to add and remove permissions on server-level securables, bringing them into line with the documented requirements.Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. + +Review the permissions actually in place on the server. + +If the actual permissions do not match the documented requirements, this is a finding. + +Use the supplemental file "Instance permissions assignments to logins and roles.sql."SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004000SQL Server must protect against a user falsely repudiating by ensuring all accounts are individual, unique, and not shared.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93833V-79127CCI-000166Remove user-accessible shared accounts and use individual user IDs. + +Build/configure applications to ensure successful individual authentication prior to shared account access. + +Ensure each user's identity is received and used in audit data in all relevant circumstances. + +Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.Obtain the list of authorized SQL Server accounts in the system documentation. + +Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. + +If accounts are determined to be shared, determine if individuals are first individually authenticated. + +If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. + +The key is individual accountability. If this can be traced, this is not a finding. + +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. + +Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. + +If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. + +Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004100SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. + +Any user with enough access to the server can execute a task that will be run as NT AUTHORITY\SYSTEM either using task scheduler or other tools. At this point, NT AUTHORITY\SYSTEM essentially becomes a shared account because the operating system and SQL Server are unable to determine who created the process. + +Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role by default. This allowed jobs/tasks to be executed in SQL Server without the approval or knowledge of the DBA because it looked like operating system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93835V-79129CCI-000166Remove permissions that were identified as not allowed in the check content. USE Master; @@ -284,18 +284,18 @@ REVERT GO - + If IsClustered returns 1, IsHadrEnabled returns 0, and any permissions have been granted to the Local System account beyond "CONNECT SQL", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding. - + If IsHadrEnabled returns 1 and any permissions have been granted to the Local System account beyond "CONNECT SQL", "CREATE AVAILABILITY GROUP", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE", and "VIEW ANY DATABASE", this is a finding. - + If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to the Local System account beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding. -SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004200SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. - -In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. - +SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL6-D0-004200SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. + If the computer account of a remote computer is granted access to SQL Server, any service or scheduled task running as NT AUTHORITY\SYSTEM or NT AUTHORITY\NETWORK SERVICE can log into the instance and perform actions. These actions cannot be traced back to a specific user or process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93837V-79131CCI-000166Remove all logins that were returned in the check content.Execute the following query: SELECT name @@ -317,2317 +317,1533 @@ Note: <name> represents the username portion of the login. For example, if If no account information is returned, this is not a finding. -If account information is returned, this is a finding.SRG-APP-000089-DB-000064<GroupDescription></GroupDescription>SQL6-D0-004300SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.<VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. +If account information is returned, this is a finding.SRG-APP-000089-DB-000064<GroupDescription></GroupDescription>SQL6-D0-004300SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.<VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +Audit records can be generated from various components within SQL Server (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. + +DoD has defined the list of events for which SQL Server will provide an audit record generation capability as the following: + +(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); + +(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and + +(iii) All account creation, modification, disabling, and termination actions. + +Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93839V-79133CCI-000169Add all required audit events to the STIG Compliant audit specification server documentation.Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. + +Execute the following query to get all of the installed audits: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. + +To view the actions being audited by the audits, execute the following query: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 + +Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding.SRG-APP-000090-DB-000065<GroupDescription></GroupDescription>SQL6-D0-004400SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.<VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. + +Suppression of auditing could permit an adversary to evade detection. + +Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93841V-79135CCI-000171Create a server role specifically for audit maintainers and give it permission to maintain audits without granting it unnecessary permissions (the role name used here is an example; other names may be used): + +CREATE SERVER ROLE SERVER_AUDIT_MAINTAINERS; +GO + +GRANT ALTER ANY SERVER AUDIT TO SERVER_AUDIT_MAINTAINERS; +GO + +Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY SERVER AUDIT permission from all logins. Then, for each authorized login, run the statement: + +ALTER SERVER ROLE SERVER_AUDIT_MAINTAINERS ADD MEMBER; +GO + +Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL SERVER, ALTER ANY DATABASE and CREATE ANY DATABASE permissions from logins that do not need them.Obtain the list of approved audit maintainers from the system documentation. + +Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. + +sysadmin +dbcreator + +Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. + +ALTER ANY SERVER AUDIT +CONTROL SERVER +ALTER ANY DATABASE +CREATE ANY DATABASE + +Use the following query to determine the roles and logins that have the listed permissions: + +SELECT-- DISTINCT + CASE + WHEN SP.class_desc IS NOT NULL THEN + CASE + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' + ELSE SP.class_desc + END + WHEN E.name IS NOT NULL THEN 'ENDPOINT' + WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' + WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' + WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' + ELSE '???' + END AS [Securable Class], + CASE + WHEN E.name IS NOT NULL THEN E.name + WHEN S.name IS NOT NULL THEN S.name + WHEN P.name IS NOT NULL THEN P.name + ELSE '???' + END AS [Securable], + P1.name AS [Grantee], + P1.type_desc AS [Grantee Type], + sp.permission_name AS [Permission], + sp.state_desc AS [State], + P2.name AS [Grantor], + P2.type_desc AS [Grantor Type], +R.name AS [Role Name] +FROM + sys.server_permissions SP + INNER JOIN sys.server_principals P1 + ON P1.principal_id = SP.grantee_principal_id + INNER JOIN sys.server_principals P2 + ON P2.principal_id = SP.grantor_principal_id + + FULL OUTER JOIN sys.servers S + ON SP.class_desc = 'SERVER' + AND S.server_id = SP.major_id + + FULL OUTER JOIN sys.endpoints E + ON SP.class_desc = 'ENDPOINT' + AND E.endpoint_id = SP.major_id + + FULL OUTER JOIN sys.server_principals P + ON SP.class_desc = 'SERVER_PRINCIPAL' + AND P.principal_id = SP.major_id + +FULL OUTER JOIN sys.server_role_members SRM +ON P.principal_id = SRM.member_principal_id + +LEFT OUTER JOIN sys.server_principals R +ON SRM.role_principal_id = R.principal_id +WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') +OR R.name IN ('sysadmin','dbcreator') + +If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.SRG-APP-000091-DB-000066<GroupDescription></GroupDescription>SQL6-D0-004500SQL Server must generate audit records when privileges/permissions are retrieved.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. + +This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93843V-79137CCI-000172If SQL Server is required to audit the retrieval of privilege/permission/role membership information, create a dedicated audit to capture this information. + +USE [master]; +GO + +Set variables needed by setup script: +DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid uniqueidentifier, @auditFileSize varchar(4), @auditFileCount varchar(4) + +Define the name of the audit: +SET @auditName = 'STIG_Audit_Permissions_Queries' + +Define the directory in which audit log files reside: +SET @auditPath = 'C:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audits' + +Define the unique identifier for the audit: +SET @auditGuid = NEWID() + +Define the maximum size for a single audit file (MB): +SET @auditFileSize = 200 + +Define the number of files that should be kept online. Use -1 for unlimited: +SET @auditFileCount = 50 + +Insert the variables into a temp table so they survive for the duration of the script: +CREATE TABLE #SetupVars +( + Variable varchar(50), + Value varchar(260) +) +INSERT INTO #SetupVars (Variable, Value) + VALUES ('auditName', @auditName), + ('auditPath', @auditPath), + ('auditGuid', convert(varchar(40), @auditGuid)), + ('auditFileSize', @auditFileSize), + ('auditFileCount', @auditFileCount) +GO + +Delete the audit if it currently exists: + +Disable the Server Audit Specification: +DECLARE @auditName varchar(50), @disableSpecification nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @disableSpecification = ' +IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') +ALTER SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] WITH (STATE = OFF);' +EXEC(@disableSpecification) +GO + +Drop the Server Audit Specification: +DECLARE @auditName varchar(50), @dropSpecification nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @dropSpecification = ' +IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') +DROP SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION];' +EXEC(@dropSpecification) +GO + +Disable the Server Audit: +DECLARE @auditName varchar(50), @disableAudit nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @disableAudit = ' +IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') +ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = OFF);' +EXEC(@disableAudit) +GO + +Drop the Server Audit: +DECLARE @auditName varchar(50), @dropAudit nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @dropAudit = ' +IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') +DROP SERVER AUDIT [' + @auditName + '];' +EXEC(@dropAudit) +GO + +Set up the SQL Server Audit: + +USE [master]; +GO + +Create the Server Audit: +DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid varchar(40), @auditFileSize varchar(4), @auditFileCount varchar(5) + +SELECT @auditName = Value FROM #SetupVars WHERE Variable = 'auditName' +SELECT @auditPath = Value FROM #SetupVars WHERE Variable = 'auditPath' +SELECT @auditGuid = Value FROM #SetupVars WHERE Variable = 'auditGuid' +SELECT @auditFileSize = Value FROM #SetupVars WHERE Variable = 'auditFileSize' +SELECT @auditFileCount = Value FROM #SetupVars WHERE Variable = 'auditFileCount' + +DECLARE @createStatement nvarchar(max) +SET @createStatement = ' +CREATE SERVER AUDIT [' + @auditName + '] +TO FILE +( + FILEPATH = ''' + @auditPath + ''' + , MAXSIZE = ' + @auditFileSize + ' MB + , MAX_ROLLOVER_FILES = ' + CASE WHEN @auditFileCount = -1 THEN 'UNLIMITED' ELSE @auditFileCount END + ' + , RESERVE_DISK_SPACE = OFF +) +WITH +( + QUEUE_DELAY = 1000 + , ON_FAILURE = SHUTDOWN + , AUDIT_GUID = ''' + @auditGuid + ''' +) +WHERE ([Schema_Name] = ''sys'' AND [Object_Name] = ''all_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_permissions'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_principals'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_role_members'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_column_store_object_pool'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_db_xtp_object_stats'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_os_memory_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_object_columns'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_session_object_columns'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''filetable_system_defined_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''linked_logins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''login_token'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''remote_logins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_permissions'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principal_credentials'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principals'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_role_members'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sql_logins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syscacheobjects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syslogins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysobjects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysoledbusers'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syspermissions'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysremotelogins'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''system_objects'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysusers'') +OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''user_token'') +' + +EXEC(@createStatement) +GO + +Turn on the Audit: +DECLARE @auditName varchar(50), @enableAudit nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @enableAudit = ' +IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') +ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = ON);' +EXEC(@enableAudit) +GO + +Create the server audit specifications: +DECLARE @auditName varchar(50), @createSpecification nvarchar(max) +SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') +SET @createSpecification = ' +CREATE SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] +FOR SERVER AUDIT [' + @auditName + '] + ADD (SCHEMA_OBJECT_ACCESS_GROUP) +WITH (STATE = ON);' +EXEC(@createSpecification) +GO + +Clean up: +DROP TABLE #SetupVarsReview the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000091-DB-000325<GroupDescription></GroupDescription>SQL6-D0-004600SQL Server must generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. + +This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93845V-79139CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000092-DB-000208<GroupDescription></GroupDescription>SQL6-D0-004700SQL Server must initiate session auditing upon startup.<VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93847V-79141CCI-001464Configure the SQL Audit(s) to automatically start during system start-up. + +ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON + +Execute the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status +WHERE status_desc = 'STARTED' + +Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.When Audits are enabled, they start up when the instance starts. +https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 + +Check if an audit is configured and enabled. + +Execute the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status +WHERE status_desc = 'STARTED' + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.SRG-APP-000101-DB-000044<GroupDescription></GroupDescription>SQL6-D0-005500SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events. + +The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of users of shared accounts, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. + +Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93851V-79145CCI-000135Design and deploy an Audit that captures all auditable events and data items. In the event a third-party tool is used for auditing it must contain all the required information including but not limited to events, type, location, subject, date and time and by whom the change occurred. + +Implement additional custom audits to capture the additional organizational required information.If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. + +Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit. + +If there are none specified, this is not a finding. + +If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements. + +If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.SRG-APP-000109-DB-000049<GroupDescription></GroupDescription>SQL6-D0-005600SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. + +When the need for system availability does not outweigh the need for a complete audit trail, SQL Server should shut down immediately, rolling back all in-flight transactions. + +Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93853V-79147CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs. + +Run this T-SQL script for each identified audit: + +ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF); +GO +ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN); +GO +ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON); +GOIf the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). + +If SQL Server Audit is in use, review the defined server audits by running the statement: + +SELECT * FROM sys.server_audits; + +By observing the [name] and [is_state_enabled] columns, identify the row or rows in use. + +If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.SRG-APP-000109-DB-000321<GroupDescription></GroupDescription>SQL6-D0-005700SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. + +When availability is an overriding concern, approved actions in response to an audit failure are as follows: + +(i) If the failure was caused by the lack of audit record storage capacity, SQL Server must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. + +(ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, SQL Server must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. + +Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93855V-79149CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. + +Run this T-SQL script for each identified audit: + +ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF); +GO +ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue); +GO +ALTER SERVER AUDIT [AuditName] WITH (STATE = ON); +GOIf the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). -Audit records can be generated from various components within SQL Server (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. +Execute the following query: -DoD has defined the list of events for which SQL Server will provide an audit record generation capability as the following: +SELECT a.name 'audit_name', + a.type_desc 'storage_type', + f.max_rollover_files +FROM sys.server_audits a +LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id +WHERE a.is_state_enabled = 1 -(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); +If no records are returned, this is a finding. -(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and +If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG", this is not a finding. -(iii) All account creation, modification, disabling, and termination actions. +If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding. +SRG-APP-000118-DB-000059<GroupDescription></GroupDescription>SQL6-D0-005900The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.<VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. -Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93839V-79133CCI-000169Add all required audit events to the STIG Compliant audit specification server documentation.Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. +To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. -Execute the following query to get all of the installed audits: +This requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections and limiting log data location. -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. SQL Server is an application that is able to view and manipulate audit file data. -All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. +Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. -To view the actions being audited by the audits, execute the following query: +Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93857V-79151CCI-000162CCI-000163CCI-000164Modify audit file permissions to meet the requirement to protect against unauthorized access. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 +Application event log and security log permissions are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use. -Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding.SRG-APP-000090-DB-000065<GroupDescription></GroupDescription>SQL6-D0-004400SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.<VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. +Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file and click "Properties". + +On the Security tab, modify the security permissions to: +Administrator (read) +Users (none) +Audit Administrator(Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] + +----- +Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.130).aspx. + +Note 2: Tips for adding a service SID/virtual account to a folder's permission list. + +1) In Windows Explorer, right-click the folder and select "Properties". +2) Select the "Security" tab. +3) Click "Edit". +4) Click "Add". +5) Click "Locations". +6) Select the computer name. +7) Search for the name. +7.a) SQL Server Service +7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) +7.a.ii) Select the "MSSQL$" user and click "OK". +7.b) SQL Agent Service +7.b.i) Type "NT SERVICE\SQL" and click "Check Names". +7.b.ii) Select the "SQLAgent$" user and click "OK". +8) Click "OK". +9) Permission like a normal user from here.If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A. + +Obtain the SQL Server audit file location(s) by running the following SQL script: + +SELECT log_file_path AS "Audit Path" +FROM sys.server_file_audits + +For each audit, the path column will give the location of the file. + +Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. + +Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: + +Administrator (read) +Users (none) +Audit Administrator (Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.SRG-APP-000121-DB-000202<GroupDescription></GroupDescription>SQL6-D0-006200SQL Server must protect its audit features from unauthorized access.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. + +Depending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. It is, therefore, imperative that access to audit tools be controlled and protected from unauthorized access. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, OS-provided audit tools, vendor-provided audit tools, and open source audit tools needed to successfully view and manipulate audit information system activity and records. + +If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93863V-79157CCI-001493Remove audit-related permissions from individuals and roles not authorized to have them. + +USE master; +DENY [ALTER ANY SERVER AUDIT] TO [User]; +GOCheck the server documentation for a list of approved users with access to SQL Server Audits. + +To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. To view an Audit log requires the CONTROL SERVER permission. To use Profiler, ALTER TRACE is required. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER, ALTER TRACE: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding.SRG-APP-000122-DB-000203<GroupDescription></GroupDescription>SQL6-D0-006300SQL Server must protect its audit configuration from unauthorized modification.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93865V-79159CCI-001494Remove audit-related permissions from individuals and roles not authorized to have them. + +USE master; +DENY [ALTER ANY SERVER AUDIT] TO [User]; +GOCheck the server documentation for a list of approved users with access to SQL Server Audits. + +To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding.SRG-APP-000123-DB-000204<GroupDescription></GroupDescription>SQL6-D0-006400SQL Server must protect its audit features from unauthorized removal.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93867V-79161CCI-001495Remove audit-related permissions from individuals and roles not authorized to have them. + +USE master; +DENY [ALTER ANY SERVER AUDIT] TO [User]; +GOCheck the server documentation for a list of approved users with access to SQL Server Audits. + +To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006500SQL Server must limit privileges to change software modules and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. + +Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93869V-79163CCI-001499Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. + +If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. + +To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. + +Navigate to the folder above, and review the "Binn" subdirectory.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006600SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. + +Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79165SV-93871CCI-001499Implement and document a process by which changes made to software libraries are monitored and alerted. -Suppression of auditing could permit an adversary to evade detection. +A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files. -Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93841V-79135CCI-000171Create a server role specifically for audit maintainers and give it permission to maintain audits without granting it unnecessary permissions (the role name used here is an example; other names may be used): +Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file. -CREATE SERVER ROLE SERVER_AUDIT_MAINTAINERS; -GO +Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. -GRANT ALTER ANY SERVER AUDIT TO SERVER_AUDIT_MAINTAINERS; -GO +If alerts do not at least hash their value, this is a finding. -Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove the ALTER ANY SERVER AUDIT permission from all logins. Then, for each authorized login, run the statement: +To determine the location for these instance-specific binaries: -ALTER SERVER ROLE SERVER_AUDIT_MAINTAINERS ADD MEMBER; -GO +Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property -Use REVOKE and/or DENY and/or ALTER SERVER ROLE ... DROP MEMBER ... statements to remove CONTROL SERVER, ALTER ANY DATABASE and CREATE ANY DATABASE permissions from logins that do not need them.Obtain the list of approved audit maintainers from the system documentation. - -Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. - -sysadmin -dbcreator - -Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. - -ALTER ANY SERVER AUDIT -CONTROL SERVER -ALTER ANY DATABASE -CREATE ANY DATABASE - -Use the following query to determine the roles and logins that have the listed permissions: - -SELECT-- DISTINCT - CASE - WHEN SP.class_desc IS NOT NULL THEN - CASE - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' - ELSE SP.class_desc - END - WHEN E.name IS NOT NULL THEN 'ENDPOINT' - WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' - WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' - WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' - ELSE '???' - END AS [Securable Class], - CASE - WHEN E.name IS NOT NULL THEN E.name - WHEN S.name IS NOT NULL THEN S.name - WHEN P.name IS NOT NULL THEN P.name - ELSE '???' - END AS [Securable], - P1.name AS [Grantee], - P1.type_desc AS [Grantee Type], - sp.permission_name AS [Permission], - sp.state_desc AS [State], - P2.name AS [Grantor], - P2.type_desc AS [Grantor Type], -R.name AS [Role Name] -FROM - sys.server_permissions SP - INNER JOIN sys.server_principals P1 - ON P1.principal_id = SP.grantee_principal_id - INNER JOIN sys.server_principals P2 - ON P2.principal_id = SP.grantor_principal_id - - FULL OUTER JOIN sys.servers S - ON SP.class_desc = 'SERVER' - AND S.server_id = SP.major_id - - FULL OUTER JOIN sys.endpoints E - ON SP.class_desc = 'ENDPOINT' - AND E.endpoint_id = SP.major_id - - FULL OUTER JOIN sys.server_principals P - ON SP.class_desc = 'SERVER_PRINCIPAL' - AND P.principal_id = SP.major_id - -FULL OUTER JOIN sys.server_role_members SRM -ON P.principal_id = SRM.member_principal_id - -LEFT OUTER JOIN sys.server_principals R -ON SRM.role_principal_id = R.principal_id -WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') -OR R.name IN ('sysadmin','dbcreator') - -If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding.SRG-APP-000091-DB-000066<GroupDescription></GroupDescription>SQL6-D0-004500SQL Server must generate audit records when privileges/permissions are retrieved.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. - -This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93843V-79137CCI-000172If SQL Server is required to audit the retrieval of privilege/permission/role membership information, create a dedicated audit to capture this information. - -USE [master]; -GO +TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.SRG-APP-000133-DB-000198<GroupDescription></GroupDescription>SQL6-D0-006700SQL Server software installation account must be restricted to authorized users.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects on the overall security of the system. + +If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed access to information system components for purposes of initiating changes, including upgrades and modifications. + +DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93873V-79167CCI-001499From a command prompt, open lusrmgr.msc. Navigate to Users >> right-click Individual User >> Properties >> Member Of. + +Configure SQL Server and OS settings and access controls to restrict user access to objects and data that the user is authorized to view/use.From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. + +sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" +Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " + +If any accounts are shown that are not authorized in the system documentation, this is a finding.SRG-APP-000133-DB-000199<GroupDescription></GroupDescription>SQL6-D0-006800Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. + +Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93875V-79169CCI-001499Re-install SQL Server application components using dedicated directories that are separate from the operating system. + +Relocate or reinstall other application software that currently shares directories with SQL Server components. + +Separate from the operating system and/or temporary storage.Determine the directory in which SQL Server has been installed: -Set variables needed by setup script: -DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid uniqueidentifier, @auditFileSize varchar(4), @auditFileCount varchar(4) +Using SQL Server Management Studio's Object Explorer: +- Right-click [SQL Server Instance] +- Select "Facets" +- Record the value of RootDirectory -Define the name of the audit: -SET @auditName = 'STIG_Audit_Permissions_Queries' +Determine the Operating System directory: +- Click "Start" +- Type "Run" +- Press "Enter" +- Type "%windir%" +- Click "Ok" +- Record the value in the address bar -Define the directory in which audit log files reside: -SET @auditPath = 'C:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audits' +Verify the SQL Server RootDirectory is not in the Operating System directory. -Define the unique identifier for the audit: -SET @auditGuid = NEWID() +Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding. -Define the maximum size for a single audit file (MB): -SET @auditFileSize = 200 +Verify the SQL Server RootDirectory is not in another application's directory. -Define the number of files that should be kept online. Use -1 for unlimited: -SET @auditFileCount = 50 +Navigate to the SQL RootDirectory using Windows Explorer. -Insert the variables into a temp table so they survive for the duration of the script: -CREATE TABLE #SetupVars -( - Variable varchar(50), - Value varchar(260) -) -INSERT INTO #SetupVars (Variable, Value) - VALUES ('auditName', @auditName), - ('auditPath', @auditPath), - ('auditGuid', convert(varchar(40), @auditGuid)), - ('auditFileSize', @auditFileSize), - ('auditFileCount', @auditFileCount) -GO +Examine each directory for evidence another application is stored in it. -Delete the audit if it currently exists: +If evidence exists the SQL RootDirectory is in another application's directory, this is a finding. -Disable the Server Audit Specification: -DECLARE @auditName varchar(50), @disableSpecification nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @disableSpecification = ' -IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') -ALTER SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] WITH (STATE = OFF);' -EXEC(@disableSpecification) -GO +If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding. -Drop the Server Audit Specification: -DECLARE @auditName varchar(50), @dropSpecification nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @dropSpecification = ' -IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = N''' + @auditName + '_SERVER_SPECIFICATION'') -DROP SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION];' -EXEC(@dropSpecification) -GO +Examples: +1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding. -Disable the Server Audit: -DECLARE @auditName varchar(50), @disableAudit nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @disableAudit = ' -IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') -ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = OFF);' -EXEC(@disableAudit) -GO +2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding. -Drop the Server Audit: -DECLARE @auditName varchar(50), @dropAudit nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @dropAudit = ' -IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') -DROP SERVER AUDIT [' + @auditName + '];' -EXEC(@dropAudit) -GO +3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.SRG-APP-000141-DB-000090<GroupDescription></GroupDescription>SQL6-D0-006900Default demonstration and sample databases, database objects, and applications must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality, not required for every mission, that cannot be disabled. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities. + +Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93877V-79171CCI-000381Remove all demonstration or sample databases from production instances.Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. + +If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: + +pubs +Northwind +AdventureWorks +WorldwideImporters + +If any of these databases exist, this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL6-D0-007000Unused database components, DBMS software, and database objects must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93879V-79173CCI-000381Remove all features that are not required.From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. + +If any features are installed, but are not required, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-007100Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities. + +Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93881V-79175CCI-000381Disable any unused components or features that cannot be uninstalled.From the server documentation, obtain a listing of required components. -Set up the SQL Server Audit: +Generate a listing of components installed on the server. -USE [master]; -GO +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" -Create the Server Audit: -DECLARE @auditName varchar(50), @auditPath varchar(260), @auditGuid varchar(40), @auditFileSize varchar(4), @auditFileCount varchar(5) +Compare the feature listing against the required components listing. Note any components that are installed, but not required. -SELECT @auditName = Value FROM #SetupVars WHERE Variable = 'auditName' -SELECT @auditPath = Value FROM #SetupVars WHERE Variable = 'auditPath' -SELECT @auditGuid = Value FROM #SetupVars WHERE Variable = 'auditGuid' -SELECT @auditFileSize = Value FROM #SetupVars WHERE Variable = 'auditFileSize' -SELECT @auditFileCount = Value FROM #SetupVars WHERE Variable = 'auditFileCount' +Launch SQL Server Configuration Manager. -DECLARE @createStatement nvarchar(max) -SET @createStatement = ' -CREATE SERVER AUDIT [' + @auditName + '] -TO FILE -( - FILEPATH = ''' + @auditPath + ''' - , MAXSIZE = ' + @auditFileSize + ' MB - , MAX_ROLLOVER_FILES = ' + CASE WHEN @auditFileCount = -1 THEN 'UNLIMITED' ELSE @auditFileCount END + ' - , RESERVE_DISK_SPACE = OFF -) -WITH -( - QUEUE_DELAY = 1000 - , ON_FAILURE = SHUTDOWN - , AUDIT_GUID = ''' + @auditGuid + ''' -) -WHERE ([Schema_Name] = ''sys'' AND [Object_Name] = ''all_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_permissions'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_principals'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''database_role_members'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_column_store_object_pool'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_db_xtp_object_stats'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_os_memory_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_object_columns'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''dm_xe_session_object_columns'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''filetable_system_defined_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''linked_logins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''login_token'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''remote_logins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_permissions'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principal_credentials'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_principals'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''server_role_members'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sql_logins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syscacheobjects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syslogins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysobjects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysoledbusers'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''syspermissions'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysremotelogins'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''system_objects'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''sysusers'') -OR ([Schema_Name] = ''sys'' AND [Object_Name] = ''user_token'') -' - -EXEC(@createStatement) -GO +If any components that are installed but are not required are not disabled, this is a finding. -Turn on the Audit: -DECLARE @auditName varchar(50), @enableAudit nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @enableAudit = ' -IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = N''' + @auditName + ''') -ALTER SERVER AUDIT [' + @auditName + '] WITH (STATE = ON);' -EXEC(@enableAudit) -GO +If any required components are not installed, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007200Access to xp_cmdshell must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93883V-79177CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. -Create the server audit specifications: -DECLARE @auditName varchar(50), @createSpecification nvarchar(max) -SET @auditName = (SELECT Value FROM #SetupVars WHERE Variable = 'auditName') -SET @createSpecification = ' -CREATE SERVER AUDIT SPECIFICATION [' + @auditName + '_SERVER_SPECIFICATION] -FOR SERVER AUDIT [' + @auditName + '] - ADD (SCHEMA_OBJECT_ACCESS_GROUP) -WITH (STATE = ON);' -EXEC(@createSpecification) -GO +To disable the use of xp_cmdshell, from the query prompt:  -Clean up: -DROP TABLE #SetupVarsReview the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. +EXEC sp_configure 'show advanced options', 1;  +GO  +RECONFIGURE;  +GO  +EXEC sp_configure 'xp_cmdshell', 0;  +GO  +RECONFIGURE;  +GO??The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. + +To determine if xp_cmdshell is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'xp_cmdshell'; + +If the value of "config_value" is "0", this is not a finding. + +Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007300Access to CLR code must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93885V-79179CCI-000381Disable use of or remove any CLR code that is not authorized. + +To disable the use of CLR, from the query prompt: + +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'clr enabled', 0; +GO +RECONFIGURE; +GO + +For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. + +To determine if CLR is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'clr enabled'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. + +If CLR code is approved, check the database for UNSAFE assembly permission using the following script: -If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. +USE [master] +SELECT * +FROM sys.assemblies +WHERE permission_set_desc != 'SAFE' +AND is_user_defined = 1; -If the documentation does not exist, this is a finding. +If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007400Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93887V-79181CCI-000381Remove any Non-Standard extended stored procedures that are not documented and approved. + +sp_dropextendedproc 'proc name'Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. + +Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible. + +To determine if non-standard extended stored procedures exist, run the following: -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. +------------------------------------------------------------------------ +USE [master] +GO +DECLARE @xplist AS TABLE +( + xp_name sysname, + source_dll nvarchar(255) +) +INSERT INTO @xplist +EXEC sp_helpextendedproc -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name +------------------------------------------------------------------------ + +If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved. -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification: +If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007500Access to linked servers must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93889V-79183CCI-000381Disable use of or remove any linked servers that are not authorized. + +To remove a linked server and all associated logins run the following: + +sp_dropserver 'LinkedServerName', 'droplogins'; + +To remove a login from a linked server run the following: + +EXEC sp_droplinkedsrvlogin 'LoginName', NULL;A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. + +To obtain a list of linked servers, execute the following command: + +EXEC sp_linkedservers; + +Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. + +Run the following to get a linked server login mapping: + +SELECT s.name, p.principal_id, l.remote_name +FROM sys.servers s +JOIN sys.linked_logins l ON s.server_id = l.server_id +LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id +WHERE s.is_linked = 1 + +Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007600SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary protocols on information systems. + +Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. + +To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of protocols to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. + +SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93891V-79185CCI-000382In SQL Server Configuration Manager >> SQL Server Network Configuration >> Protocols, right-click on each listed protocol that is enabled but not authorized and Select "Disable".To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. + +If Named Pipes is enabled and not specifically required and authorized, this is a finding. + +If any listed protocol is enabled but not authorized, this is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007700SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports on information systems. + +Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. + +To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. + +SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93893V-79187CCI-000382Use SQL Server Configuration to change the ports used by SQL Server to comply with PPSM guidance, or document the need for other ports, and obtain written approval. Close ports no longer needed.Review SQL Server Configuration for the ports used by SQL Server. + +To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) + +If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding.SRG-APP-000148-DB-000103<GroupDescription></GroupDescription>SQL6-D0-007800SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).<VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. + +Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: + +(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and +(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93895V-79189CCI-000764Remove user-accessible shared accounts and use individual userIDs. + +Configure applications to ensure successful individual authentication prior to shared account access. + +Ensure each user's identity is received and used in audit data in all relevant circumstances.Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) + +If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. + +If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. + +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-007900If DBMS authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity and lifetime.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. + +The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93897V-79191CCI-000192Configure the SQL Server operating system and SQL Server logins for compliance. + +1. Ensure the password complexity requirements for the corresponding DISA Windows Server Security Technical Implementation Guide are met on the server where the SQL Server Instance is installed. + +2. Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +CREATE LOGIN <login_name> WITH PASSWORD= <enterStrongPasswordHere>, CHECK_EXPIRATION = ON, CHECK_POLICY = ON; +Check for use of SQL Server Authentication: -If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000091-DB-000325<GroupDescription></GroupDescription>SQL6-D0-004600SQL Server must generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.<VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. +SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode] -This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted. +If the returned value in the “[Authentication Mode]” column is “Windows Authentication”, this is not a finding. -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93845V-79139CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. +SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system. -If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. +Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement: -If the documentation does not exist, this is a finding. +SELECT [name], is_expiration_checked, is_policy_checked +FROM sys.sql_logins -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. +Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, and ##MS_PolicyEventProcessingLogin##. -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +If any account doesn't have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding. -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. +Review the Operating System settings relating to password complexity. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +Determine whether the following rules are enforced. If any are not, this is a finding. -If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000092-DB-000208<GroupDescription></GroupDescription>SQL6-D0-004700SQL Server must initiate session auditing upon startup.<VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93847V-79141CCI-001464Configure the SQL Audit(s) to automatically start during system start-up. +Check the server operating system for password complexity: -ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON +Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy and to review the local policies on the machine. Account Policy >> Password Policy: -Execute the following query: +Ensure the DISA Windows Password Policy is set on the SQL Server member server.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-008000Contained databases must use Windows principals.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. + +The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93899V-79193CCI-000192Configure the SQL Server contained databases to have users originating from Windows principals. Remove any users not created from Windows principals.Execute the following query to determine if Contained Databases are used: + +SELECT * FROM sys.databases WHERE containment = 1 + +If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. + +EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' + +If any records are returned, this is a finding.SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008200If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. + +Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. + +SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93901V-79195CCI-000197Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography. -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status -WHERE status_desc = 'STARTED' +Deploy encryption to the SQL Server Network Connections. -Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.When Audits are enabled, they start up when the instance starts. -https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 +From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". -Check if an audit is configured and enabled. +Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". -Execute the following query: +In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service. -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status -WHERE status_desc = 'STARTED' +For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger. -All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.SRG-APP-000101-DB-000044<GroupDescription></GroupDescription>SQL6-D0-005500SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events. +1. Navigate to the certificate store where the FQDN certificate is stored, by typing "certlm.msc" and pressing "ENTER". -The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of users of shared accounts, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. +2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window. -Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79145SV-93851CCI-000135Design and deploy an Audit that captures all auditable events and data items. In the event a third-party tool is used for auditing it must contain all the required information including but not limited to events, type, location, subject, date and time and by whom the change occurred. +3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad. -Implement additional custom audits to capture the additional organizational required information.If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. +4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate -Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit. +5. If the SQL virtual server is currently on this node, failover to another node in your cluster, and then reboot the node where the registry change occurred. -If there are none specified, this is not a finding. +6. Repeat this procedure on all the nodes. +From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". -If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements. +Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols, where there is a placeholder for the SQL Server instance name, and click on “Properties”. -If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.SRG-APP-000109-DB-000049<GroupDescription></GroupDescription>SQL6-D0-005600SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. +On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. -When the need for system availability does not outweigh the need for a complete audit trail, SQL Server should shut down immediately, rolling back all in-flight transactions. +On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. -Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79147SV-93853CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs. +If it is not a DoD approved certificate, or if no certificate is listed, this is a finding. -Run this T-SQL script for each identified audit: +For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. -ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF); -GO -ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN); -GO -ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON); -GOIf the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). +1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER". -If SQL Server Audit is in use, review the defined server audits by running the statement: +2. In the left side of the window, expand the "Personal" folder, and click "Certificates" -SELECT * FROM sys.server_audits; +3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint. -By observing the [name] and [is_state_enabled] columns, identify the row or rows in use. +4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". -If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.SRG-APP-000109-DB-000321<GroupDescription></GroupDescription>SQL6-D0-005700SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. +5. This check needs to be run on each node of the cluster. -When availability is an overriding concern, approved actions in response to an audit failure are as follows: +If any nodes have a certificate in use by SQL that is not issued or approved by DoD, this is a finding. +SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008300Confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. -(i) If the failure was caused by the lack of audit record storage capacity, SQL Server must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-106625V-97521CCI-000197 +Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure you have a recent backup of the system and registry settings. -(ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, SQL Server must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. - -Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79149SV-93855CCI-000140If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. - -Run this T-SQL script for each identified audit: - -ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF); -GO -ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue); -GO -ALTER SERVER AUDIT [AuditName] WITH (STATE = ON); -GOIf the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). - -Execute the following query: - -SELECT a.name 'audit_name', - a.type_desc 'storage_type', - f.max_rollover_files -FROM sys.server_audits a -LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id -WHERE a.is_state_enabled = 1 - -If no records are returned, this is a finding. - -If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG", this is not a finding. - -If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding. -SRG-APP-000118-DB-000059<GroupDescription></GroupDescription>SQL6-D0-005900The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.<VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. - -To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. - -This requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections and limiting log data location. - -Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. SQL Server is an application that is able to view and manipulate audit file data. - -Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. - -Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79151SV-93857CCI-000162CCI-000163CCI-000164Modify audit file permissions to meet the requirement to protect against unauthorized access. - -Application event log and security log permissions are covered in the Windows Server STIGs. Be sure to reference these depending on the OS in use. - -Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click the file and click "Properties". - -On the Security tab, modify the security permissions to: -Administrator (read) -Users (none) -Audit Administrator(Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - ------ -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.130).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. - -1) In Windows Explorer, right-click the folder and select "Properties". -2) Select the "Security" tab. -3) Click "Edit". -4) Click "Add". -5) Click "Locations". -6) Select the computer name. -7) Search for the name. -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$" user and click "OK". -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names". -7.b.ii) Select the "SQLAgent$" user and click "OK". -8) Click "OK". -9) Permission like a normal user from here.If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A. - -Obtain the SQL Server audit file location(s) by running the following SQL script: - -SELECT log_file_path AS "Audit Path" -FROM sys.server_file_audits - -For each audit, the path column will give the location of the file. - -Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. - -Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: - -Administrator (read) -Users (none) -Audit Administrator (Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.SRG-APP-000121-DB-000202<GroupDescription></GroupDescription>SQL6-D0-006200SQL Server must protect its audit features from unauthorized access.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. - -Depending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. It is, therefore, imperative that access to audit tools be controlled and protected from unauthorized access. - -Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools. SQL Server is an application that does provide access to audit data. - -Audit tools include, but are not limited to, OS-provided audit tools, vendor-provided audit tools, and open source audit tools needed to successfully view and manipulate audit information system activity and records. - -If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79157SV-93863CCI-001493Remove audit-related permissions from individuals and roles not authorized to have them. - -USE master; -DENY [ALTER ANY SERVER AUDIT] TO [User]; -GOCheck the server documentation for a list of approved users with access to SQL Server Audits. - -To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. To view an Audit log requires the CONTROL SERVER permission. To use Profiler, ALTER TRACE is required. - -Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER, ALTER TRACE: - -SELECT login.name, perm.permission_name, perm.state_desc -FROM sys.server_permissions perm -JOIN sys.server_principals login -ON perm.grantee_principal_id = login.principal_id -WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE') -and login.name not like '##MS_%'; - -If unauthorized accounts have these privileges, this is a finding.SRG-APP-000122-DB-000203<GroupDescription></GroupDescription>SQL6-D0-006300SQL Server must protect its audit configuration from unauthorized modification.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. - -Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. SQL Server is an application that does provide access to audit data. - -Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93865V-79159CCI-001494Remove audit-related permissions from individuals and roles not authorized to have them. - -USE master; -DENY [ALTER ANY SERVER AUDIT] TO [User]; -GOCheck the server documentation for a list of approved users with access to SQL Server Audits. - -To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. - -Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT: - -SELECT login.name, perm.permission_name, perm.state_desc -FROM sys.server_permissions perm -JOIN sys.server_principals login -ON perm.grantee_principal_id = login.principal_id -WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') -and login.name not like '##MS_%'; - -If unauthorized accounts have these privileges, this is a finding.SRG-APP-000123-DB-000204<GroupDescription></GroupDescription>SQL6-D0-006400SQL Server must protect its audit features from unauthorized removal.<VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. - -Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit tools. SQL Server is an application that does provide access to audit data. - -Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93867V-79161CCI-001495Remove audit-related permissions from individuals and roles not authorized to have them. - -USE master; -DENY [ALTER ANY SERVER AUDIT] TO [User]; -GOCheck the server documentation for a list of approved users with access to SQL Server Audits. - -To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. - -Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: - -SELECT login.name, perm.permission_name, perm.state_desc -FROM sys.server_permissions perm -JOIN sys.server_principals login -ON perm.grantee_principal_id = login.principal_id -WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') -and login.name not like '##MS_%'; - -If unauthorized accounts have these privileges, this is a finding.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006500SQL Server must limit privileges to change software modules and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. - -Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79163SV-93869CCI-001499Change the ownership of all shared software libraries on disk to the authorized account. Remove any modify permissions granted to unauthorized users or groups.Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. - -If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. - -To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. - -Navigate to the folder above, and review the "Binn" subdirectory.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL6-D0-006600SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.<VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. - -Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79165SV-93871CCI-001499Implement and document a process by which changes made to software libraries are monitored and alerted. - -A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files. - -Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file. - -Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. - -If alerts do not at least hash their value, this is a finding. - -To determine the location for these instance-specific binaries: - -Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property - -TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.SRG-APP-000133-DB-000198<GroupDescription></GroupDescription>SQL6-D0-006700SQL Server software installation account must be restricted to authorized users.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects on the overall security of the system. - -If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed access to information system components for purposes of initiating changes, including upgrades and modifications. - -DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79167SV-93873CCI-001499From a command prompt, open lusrmgr.msc. Navigate to Users >> right-click Individual User >> Properties >> Member Of. - -Configure SQL Server and OS settings and access controls to restrict user access to objects and data that the user is authorized to view/use.From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. - -sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" -Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " - -If any accounts are shown that are not authorized in the system documentation, this is a finding.SRG-APP-000133-DB-000199<GroupDescription></GroupDescription>SQL6-D0-006800Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79169SV-93875CCI-001499Re-install SQL Server application components using dedicated directories that are separate from the operating system. - -Relocate or reinstall other application software that currently shares directories with SQL Server components. - -Separate from the operating system and/or temporary storage.Determine the directory in which SQL Server has been installed: - -Using SQL Server Management Studio's Object Explorer: -- Right-click [SQL Server Instance] -- Select "Facets" -- Record the value of RootDirectory - -Determine the Operating System directory: -- Click "Start" -- Type "Run" -- Press "Enter" -- Type "%windir%" -- Click "Ok" -- Record the value in the address bar - -Verify the SQL Server RootDirectory is not in the Operating System directory. - -Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding. - -Verify the SQL Server RootDirectory is not in another application's directory. - -Navigate to the SQL RootDirectory using Windows Explorer. - -Examine each directory for evidence another application is stored in it. - -If evidence exists the SQL RootDirectory is in another application's directory, this is a finding. - -If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding. - -Examples: -1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding. - -2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding. - -3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.SRG-APP-000141-DB-000090<GroupDescription></GroupDescription>SQL6-D0-006900Default demonstration and sample databases, database objects, and applications must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality, not required for every mission, that cannot be disabled. - -DBMSs must adhere to the principles of least functionality by providing only essential capabilities. - -Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79171SV-93877CCI-000381Remove all demonstration or sample databases from production instances.Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. - -If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: - -pubs -Northwind -AdventureWorks -WorldwideImporters - -If any of these databases exist, this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL6-D0-007000Unused database components, DBMS software, and database objects must be removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. - -DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79173SV-93879CCI-000381Remove all features that are not required.From the server documentation, obtain a listing of required components. - -Generate a listing of components installed on the server. - -Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" - -Compare the feature listing against the required components listing. - -If any features are installed, but are not required, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-007100Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. - -DBMSs must adhere to the principles of least functionality by providing only essential capabilities. - -Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93881V-79175CCI-000381Disable any unused components or features that cannot be uninstalled.From the server documentation, obtain a listing of required components. - -Generate a listing of components installed on the server. - -Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" - -Compare the feature listing against the required components listing. Note any components that are installed, but not required. - -Launch SQL Server Configuration Manager. - -If any components that are installed but are not required are not disabled, this is a finding. - -If any required components are not installed, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007200Access to xp_cmdshell must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93883V-79177CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. - -To disable the use of xp_cmdshell, from the query prompt:  - -EXEC sp_configure 'show advanced options', 1;  -GO  -RECONFIGURE;  -GO  -EXEC sp_configure 'xp_cmdshell', 0;  -GO  -RECONFIGURE;  -GO??The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. - -To determine if xp_cmdshell is enabled, execute the following commands: - -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'xp_cmdshell'; - -If the value of "config_value" is "0", this is not a finding. - -Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007300Access to CLR code must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93885V-79179CCI-000381Disable use of or remove any CLR code that is not authorized. - -To disable the use of CLR, from the query prompt: - -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'clr enabled', 0; -GO -RECONFIGURE; -GO - -For any approved CLR code with Unsafe or External permissions, use the ALTER ASSEMBLY to change the Permission set for the Assembly and ensure a certificate is configured.The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. - -To determine if CLR is enabled, execute the following commands: - -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'clr enabled'; - -If the value of "config_value" is "0", this is not a finding. - -If the value of "config_value" is "1", review the system documentation to determine whether the use of CLR code is approved. If it is not approved, this is a finding. - -If CLR code is approved, check the database for UNSAFE assembly permission using the following script: - -USE [master] -SELECT * -FROM sys.assemblies -WHERE permission_set_desc != 'SAFE' -AND is_user_defined = 1; - -If any records are returned, review the system documentation to determine if the use of UNSAFE assemblies is approved. If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007400Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93887V-79181CCI-000381Remove any Non-Standard extended stored procedures that are not documented and approved. - -sp_dropextendedproc 'proc name'Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. - -Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible. - -To determine if non-standard extended stored procedures exist, run the following: - ------------------------------------------------------------------------- -USE [master] -GO -DECLARE @xplist AS TABLE -( - xp_name sysname, - source_dll nvarchar(255) -) -INSERT INTO @xplist -EXEC sp_helpextendedproc - -SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name ------------------------------------------------------------------------- - -If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved. - -If it is not approved, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-007500Access to linked servers must be disabled or restricted, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93889V-79183CCI-000381Disable use of or remove any linked servers that are not authorized. - -To remove a linked server and all associated logins run the following: - -sp_dropserver 'LinkedServerName', 'droplogins'; - -To remove a login from a linked server run the following: - -EXEC sp_droplinkedsrvlogin 'LoginName', NULL;A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. - -To obtain a list of linked servers, execute the following command: - -EXEC sp_linkedservers; - -Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. - -Run the following to get a linked server login mapping: - -SELECT s.name, p.principal_id, l.remote_name -FROM sys.servers s -JOIN sys.linked_logins l ON s.server_id = l.server_id -LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id -WHERE s.is_linked = 1 - -Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007600SQL Server must be configured to prohibit or restrict the use of organization-defined protocols as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary protocols on information systems. - -Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. - -To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of protocols to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. - -SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79185SV-93891CCI-000382In SQL Server Configuration Manager >> SQL Server Network Configuration >> Protocols, right-click on each listed protocol that is enabled but not authorized and Select "Disable".To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. - -If Named Pipes is enabled and not specifically required and authorized, this is a finding. - -If any listed protocol is enabled but not authorized, this is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL6-D0-007700SQL Server must be configured to prohibit or restrict the use of organization-defined ports, as defined in the PPSM CAL and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports on information systems. - -Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. - -To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. - -SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79187SV-93893CCI-000382Use SQL Server Configuration to change the ports used by SQL Server to comply with PPSM guidance, or document the need for other ports, and obtain written approval. Close ports no longer needed.Review SQL Server Configuration for the ports used by SQL Server. - -To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) - -If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding.SRG-APP-000148-DB-000103<GroupDescription></GroupDescription>SQL6-D0-007800SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).<VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. - -Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: - -(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and -(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79189SV-93895CCI-000764Remove user-accessible shared accounts and use individual userIDs. - -Configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances.Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) - -If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. - -If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-007900If DBMS authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity and lifetime.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. - -The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79191SV-93897CCI-000192Configure the SQL Server operating system and SQL Server logins for compliance. - -1. Ensure the password complexity requirements for the corresponding DISA Windows Server Security Technical Implementation Guide are met on the server where the SQL Server Instance is installed. - -2. Ensure SQL Server is configured to inherit password complexity rules from the operating system for SQL logins. Ensure check of policy and expiration are enforced when SQL logins are created. - -CREATE LOGIN <login_name> WITH PASSWORD= <enterStrongPasswordHere>, CHECK_EXPIRATION = ON, CHECK_POLICY = ON; -Check for use of SQL Server Authentication: - -SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode] - -If the returned value in the “[Authentication Mode]” column is “Windows Authentication”, this is not a finding. - -SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system. - -Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement: - -SELECT [name], is_expiration_checked, is_policy_checked -FROM sys.sql_logins - -Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, and ##MS_PolicyEventProcessingLogin##. - -If any account doesn't have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding. - -Review the Operating System settings relating to password complexity. - -Determine whether the following rules are enforced. If any are not, this is a finding. - -Check the server operating system for password complexity: - -Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy and to review the local policies on the machine. Account Policy >> Password Policy: - -Ensure the DISA Windows Password Policy is set on the SQL Server member server.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL6-D0-008000Contained databases must use Windows principals.<VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. - -The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79193SV-93899CCI-000192Configure the SQL Server contained databases to have users originating from Windows principals. Remove any users not created from Windows principals.Execute the following query to determine if Contained Databases are used: - -SELECT * FROM sys.databases WHERE containment = 1 - -If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. - -EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' - -If any records are returned, this is a finding.SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008200If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. - -Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. - -SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79195SV-93901CCI-000197Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography. - -Deploy encryption to the SQL Server Network Connections. - -From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". - -Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". - -In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service. - -For clustered instances install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger. - -1. Navigate to the certificate store where the FQDN certificate is stored, by typing "certlm.msc" and pressing "ENTER". - -2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window. - -3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad. - -4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate - -5. If the SQL virtual server is currently on this node, failover to another node in your cluster, and then reboot the node where the registry change occurred. - -6. Repeat this procedure on all the nodes. -From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". - -Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on “Properties”. - -On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. - -On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. - -If it is not a DoD certificate, or if no certificate is listed, this is a finding. - -For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. - -1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER". - -2. In the left side of the window, expand the "Personal" folder, and click "Certificates" - -3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint. - -4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". - -5. This check needs to be run on each node of the cluster. - -If any nodes have a certificate in use by SQL that is not issued by DOD, this is a finding. -SRG-APP-000172-DB-000075<GroupDescription></GroupDescription>SQL6-D0-008300Confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. - -References: -TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 -TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-97521SV-106625CCI-000197 -Important Note: Incorrectly modifying the Windows Registry can result in serious system errors. Before making any modifications, ensure you have a recent backup of the system and registry settings. - -Access the SQL Server -Access an administrator command prompt -Type "regedit" to launch the Registry Editor - -Enable TLS 1.2: - -1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols - a.If the "TLS 1.2" key does not exist, right-click "Protocols" - b.Click New - c.Click Key - d.Type the name "TLS 1.2" - -2.Navigate to the "TLS 1.2" subkey - a.If the subkey "Client" does not exist, right-click "TLS 1.2" - b.Click New - c.Click Key - d.Type the name "Client" - e.Repeat steps A – D for the "Server" subkey - -3.Navigate to the "Client" subkey - a.If the value "Enabled" does not exist, right-click on "Client" - b.Click New - c.Click DWORD - d.Enter "Enabled" as the name - e.Repeat steps A-D for the value "DisabledByDefault" - -4.Double-click "Enabled" - -5.In Value Data, enter "1" - -6.Click OK - -7.Double-click "DisabledByDefault" - -8.In Value Data, enter "0" - -9.Click OK - -10.Repeat steps 3 – 9 for the "Server" subkey - - -Disable unwanted SSL/TLS protocol versions: - -1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols - a.If the "TLS 1.0" key does not exist, right-click "Protocols" - b.Click New - c.Click Key - d.Type the name "TLS 1.0" - -2.Navigate to the "TLS 1.0" subkey - a.If the subkey "Client" does not exist, right-click "TLS 1.0" - b.Click New - c.Click Key - d.Type the name "Client" - e.Repeat steps A – D for the "Server" subkey - -3.Navigate to the "Client" subkey - a.If the value "Enabled" does not exist, right-click on "Client" - b.Click New - c.Click DWORD - d.Enter "Enabled" as the name - e.Repeat steps A-D for the value "DisabledByDefault" - -4.Double-click "Enabled" - -5.In Value Data, enter "0" - -6.Click OK - -7.Double-click "DisabledByDefault" - -8.In Value Data, enter "1" - -9.Click OK - -10.Repeat steps 3 – 9 for the "Server" subkey - -11.Repeat steps 1 – 10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0" - -Access the SQL Server -Access an administrator command prompt -Type "regedit" to launch the Registry Editor - -Navigate to: -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 - -If this key does not exist, this is a Finding. - -Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. - -Navigate to: -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 - -Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys - -If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. -SRG-APP-000176-DB-000068<GroupDescription></GroupDescription>SQL6-D0-008400SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. - -If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where SQL Server-stored private keys are used to authenticate SQL Server to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against SQL Server system and its clients. - -Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. - -All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79197SV-93903CCI-000186Enable use of FIPS 140-2 compliant algorithms. - -Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options - -Double-click "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing." - -Click Enabled >> Apply.Review system configuration to determine whether FIPS 140-2 support has been enabled. - -Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options - -Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. - -If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. - -For more information, see https://support.microsoft.com/en-us/kb/3141890.SRG-APP-000179-DB-000114<GroupDescription></GroupDescription>SQL6-D0-008700SQL Server must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.<VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of SQL Server. - -Applications, including DBMSs, utilizing cryptography are required to use approved NIST FIPS 140-2 validated cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. - -The security functions validated as part of FIPS 140-2 for cryptographic modules are described in FIPS 140-2 Annex A. - -NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93905V-79199CCI-000803In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -In the dialog box that appears, if the radio buttons are active, click "Enabled", and then click "Apply". If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -If, in the "Security Setting" column, the value is "Disabled," this is a finding. - -https://support.microsoft.com/en-us/kb/955720SRG-APP-000180-DB-000115<GroupDescription></GroupDescription>SQL6-D0-008800SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).<VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). - -Non-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. - -Accordingly, a risk assessment is used in determining the authentication needs of the organization. - -Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93907V-79201CCI-000804Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. - -Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: - -SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') - -If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. - -If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding. - -If non-organizational users are not uniquely identified and authenticated, this is a finding.SRG-APP-000224-DB-000384<GroupDescription></GroupDescription>SQL6-D0-009200SQL Server must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.<VulnDiscussion>One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. - -The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. - -However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79203SV-93909CCI-001188Configure Windows to require the use of FIPS compliant algorithms. - -Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsVerify that Windows is configured to require the use of FIPS compliant algorithms. - -Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -If the Security Setting for this option is "Disabled", this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009500SQL Server must protect the confidentiality and integrity of all information at rest.<VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. - -User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. - -If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79205SV-93911CCI-001199Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption. - -To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on. - -Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. - -If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted. - -If full-disk encryption is being used, this is not a finding. - -If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing: - -SELECT -d.name AS [Database Name], -CASE e.encryption_state -WHEN 0 THEN 'No database encryption key present, no encryption' -WHEN 1 THEN 'Unencrypted' -WHEN 2 THEN 'Encryption in progress' -WHEN 3 THEN 'Encrypted' -WHEN 4 THEN 'Key change in progress' -WHEN 5 THEN 'Decryption in progress' -WHEN 6 THEN 'Protection change in progress' -END AS [Encryption State] -FROM sys.dm_database_encryption_keys e -RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name -WHERE d.name NOT IN ('master','model','msdb') -ORDER BY [Database Name] ; - -For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. - -Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009600The Service Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79207SV-93913CCI-001199Document and implement procedures to safely back up and store the Service Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. Also, include provisions to store the key off-site. - -BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file' -ENCRYPTION BY PASSWORD = 'password'; - -As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.Review procedures for, and evidence of backup of, the Server Service Master Key in the System Security Plan. - -If the procedures or evidence does not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009700The Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79209SV-93915CCI-001199Document and implement procedures to safely back up and store the Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Master Key. Also, include provisions to store the key off-site. - -BACKUP MASTER KEY TO FILE = 'path_to_file' -ENCRYPTION BY PASSWORD = 'password'; - -As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.If the application owner and Authorizing Official have determined that encryption of data at rest is not required, this is not a finding. - -Review procedures for, and evidence of backup of, the Master Key in the System Security Plan. - -If the procedures or evidence does not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Master Key backup, this is a finding.SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009800SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79211SV-93917CCI-001090Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. - -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'common criteria compliance enabled', 1; -GO -RECONFIGURE -GOReview system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. - -SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. - -Review the Instance configuration: - - -SELECT value_in_use -FROM sys.configurations -WHERE name = 'common criteria compliance enabled' - -If "value_in_use" is set to "1" this is not a finding. -If "value_in_use" is set to "0" this is a finding. - -NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding. -SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009900SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79213SV-93919CCI-001090If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.Review the system documentation to determine if Instant File Initialization (IFI) is required. - -If IFI is documented as required, this is not a finding. - -Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016). - -Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment - -If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance: NT SERVICE\MSSQL$InstanceName) has been granted "Perform volume maintenance tasks" Local Rights Assignment and if it is not documented in the system documentation, this is a finding.SRG-APP-000243-DB-000374<GroupDescription></GroupDescription>SQL6-D0-010000Access to database files must be limited to relevant processes and to authorized, administrative users.<VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93921V-79215CCI-001090Remove any unauthorized permission grants from SQL Server data, log, and backup directories. - -1) On the "Security" tab, highlight the user entry. -2) Click "Remove".Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. - -To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". - -For each of the directories returned by the above script, verify whether the correct permissions have been applied. - -1) Launch Windows Explorer. -2) Navigate to the folder. -3) Right-click the folder and click "Properties". -4) Navigate to the "Security" tab. -5) Review the listing of principals and permissions. - -Account Type Directory Type Permission ------------------------------------------------------------------------------------------------ -Database Administrators ALL Full Control -SQL Server Service SID Data; Log; Backup; Full Control -SQL Server Agent Service SID Backup Full Control -SYSTEM ALL Full Control -CREATOR OWNER ALL Full Control - -For information on how to determine a "Service SID", go to: -https://aka.ms/sql-service-sids - -Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: -https://aka.ms/sqlservicepermissions - -If any additional permissions are granted but not documented as authorized, this is a finding.SRG-APP-000267-DB-000163<GroupDescription></GroupDescription>SQL6-D0-010100SQL Server must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.<VulnDiscussion>If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. - -Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. - -It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93923V-79217CCI-001314Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. - -If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio. Use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles. - -If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. - -Consider enabling trace flag 3625 to mask certain system-level error information returned to non-administrative users. - -Launch SQL Server Configuration Manager >> Click SQL Services >> Open the instance properties >> Click the Service Parameters tab >> Enter "-T3625" >> Click Add >> Click OK >> Restart SQL instance.Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. - -SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: - -USE master -GO -SELECT Name -FROM syslogins -WHERE (sysadmin = 1 or securityadmin = 1) -and hasaccess = 1; - -If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. - -In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed. - -If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio, this is a finding.SRG-APP-000340-DB-000304<GroupDescription></GroupDescription>SQL6-D0-010400SQL Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.<VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. - -System documentation should include a definition of the functionality considered privileged. - -Depending on circumstances, privileged functions can include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. - -A privileged function in SQL Server/database context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: -CREATE -ALTER -DROP -GRANT -REVOKE -DENY - -There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples include: - -TRUNCATE TABLE; -DELETE, or -DELETE affecting more than n rows, for some n, or -DELETE without a WHERE clause; - -UPDATE or -UPDATE affecting more than n rows, for some n, or -UPDATE without a WHERE clause; - -Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. - -Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93925V-79219CCI-002235Restrict the granting of permissions to server-level securables to only those authorized. Most notably, members of sysadmin and securityadmin built-in instance-level roles, CONTROL SERVER permission, and use of the GRANT with GRANT permission.Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. - -Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. - -Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. - -Get all permission assignments to logins and roles: - -SELECT DISTINCT - CASE - WHEN SP.class_desc IS NOT NULL THEN - CASE - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' - WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' - ELSE SP.class_desc - END - WHEN E.name IS NOT NULL THEN 'ENDPOINT' - WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' - WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' - WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' - ELSE '???' - END AS [Securable Class], - CASE - WHEN E.name IS NOT NULL THEN E.name - WHEN S.name IS NOT NULL THEN S.name - WHEN P.name IS NOT NULL THEN P.name - ELSE '???' - END AS [Securable], - P1.name AS [Grantee], - P1.type_desc AS [Grantee Type], - sp.permission_name AS [Permission], - sp.state_desc AS [State], - P2.name AS [Grantor], - P2.type_desc AS [Grantor Type] -FROM - sys.server_permissions SP - INNER JOIN sys.server_principals P1 - ON P1.principal_id = SP.grantee_principal_id - INNER JOIN sys.server_principals P2 - ON P2.principal_id = SP.grantor_principal_id - - FULL OUTER JOIN sys.servers S - ON SP.class_desc = 'SERVER' - AND S.server_id = SP.major_id - - FULL OUTER JOIN sys.endpoints E - ON SP.class_desc = 'ENDPOINT' - AND E.endpoint_id = SP.major_id - - FULL OUTER JOIN sys.server_principals P - ON SP.class_desc = 'SERVER_PRINCIPAL' - AND P.principal_id = SP.major_id - -Get all server role memberships: - -SELECT - R.name AS [Role], - M.name AS [Member] -FROM - sys.server_role_members X - INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id - INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id - -The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) - -Ensure only the documented and approved logins have privileged functions in SQL Server. - -If the current configuration does not match the documented baseline, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-010500Use of credentials and proxies must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. - -Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93927V-79221CCI-002233Remove any SQL Agent Proxy accounts and credentials that are not authorized. - -DROP CREDENTIAL <Credential Name> -GO - -USE [msdb] -EXEC sp_delete_proxy @proxy_name = '<Proxy Name>' -GOReview the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. - -SELECT C.name AS credential_name, C.credential_identity -FROM sys.credentials C -GO - -SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity -FROM sys.credentials C -JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id -WHERE P.enabled = 1 -GO - -If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding.SRG-APP-000356-DB-000314<GroupDescription></GroupDescription>SQL6-D0-010700SQL Server must utilize centralized management of the content captured in audit records generated by all components of SQL Server.<VulnDiscussion>Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. - -The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. - -SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93929V-79223CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. - -If the SQL Server audit records are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000356-DB-000315<GroupDescription></GroupDescription>SQL6-D0-010800SQL Server must provide centralized configuration of the content to be captured in audit records generated by all components of SQL Server.<VulnDiscussion>If the configuration of SQL Server's auditing is spread across multiple locations in the database management software, or across multiple commands, only loosely related, it is harder to use and takes longer to reconfigure in response to events. - -SQL Server must provide a unified tool for audit configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79225SV-93931CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records (to include traces used for audit purposes) are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. - -If the SQL Server audit records (to include traces used for audit purposes) are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000357-DB-000316<GroupDescription></GroupDescription>SQL6-D0-010900SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.<VulnDiscussion>In order to ensure sufficient storage capacity for the audit logs, SQL Server must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. - -The task of allocating audit record storage capacity is usually performed during initial installation of SQL Server and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. - -In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79227SV-93933CCI-001849Review the SQL Audit file location, ensure the destination has enough space available to accommodate the maximum total size of all files that could be written. - -Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. - -Update the "max_files" parameter of the audits to ensure the correct number of files is defined.Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. - -SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path" -FROM sys.server_file_audits - -Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. - -If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.SRG-APP-000359-DB-000319<GroupDescription></GroupDescription>SQL6-D0-011000SQL Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.<VulnDiscussion>Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to SQL Server on its own server will not be an issue. However, space will still be required on the server for SQL Server audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. - -If support personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. - -The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. - -Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79229SV-93935CCI-001855Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. - -If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.SRG-APP-000360-DB-000320<GroupDescription></GroupDescription>SQL6-D0-011100SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. - -The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. - -A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions - -Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79231SV-93937CCI-001858Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. - -If real-time alerts are not sent upon auditing failure, this is a finding.SRG-APP-000374-DB-000322<GroupDescription></GroupDescription>SQL6-D0-011200SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).<VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. - -Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79233SV-93939CCI-001890Where possible, configure the operating system to automatic synchronize with an official time server, using NTP. - -Where there is reason not to implement automatic synchronization with an official time server, using NTP, document the reason, and the procedure for maintaining the correct time, and obtain AO approval. Enforce the procedure.SQL Server audits store the timestamp in UTC time. - -Determine if the computer is joined to a domain. - -SELECT DEFAULT_DOMAIN()[DomainName] - -If this is not NULL, this is not a finding. - -If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) - - w32tm /query /source - -If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding. - -If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system. - -If such a procedure does not exist, this is a finding. - -If the procedure exists, review evidence that the correct time is actually maintained. - -If the evidence indicates otherwise, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011400SQL Server must enforce access restrictions associated with changes to the configuration of the instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. - -When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79235SV-93941CCI-001813Revoke unauthorized permissions from principals. - -https://msdn.microsoft.com/en-us/library/ms186308.aspx - -Remove unauthorized logins from roles. - -ALTER SERVER ROLE DROP MEMBER login; - -https://technet.microsoft.com/en-us/library/ee677634.aspxObtain a list of logins who have privileged permissions and role memberships in SQL. - -Execute the following query to obtain a list of logins and roles and their respective permissions assignment: - -SELECT p.name AS Principal, -p.type_desc AS Type, -sp.permission_name AS Permission, -sp.state_desc AS State -FROM sys.server_principals p -INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id -WHERE sp.permission_name = 'CONTROL SERVER' -OR sp.state = 'W' - -Execute the following query to obtain a list of logins and their role memberships. - -SELECT m.name AS Member, -m.type_desc AS Type, -r.name AS Role -FROM sys.server_principals m -INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id -INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id -WHERE r.name IN ('sysadmin','securityadmin','serveradmin') - -Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011500Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. - -When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79237SV-93943CCI-001813Remove users from the local Administrators group who are not authorized.Obtain a list of users who have privileged access to the server via the local Administrators group. - -Launch lusrmgr.msc -Select Groups -Double-click Administrators - -Alternatively, execute the following command in PowerShell: - -net localgroup administrators - -Check the server documentation to verify the users returned are authorized. - -If the users are not documented and authorized, this is a finding.SRG-APP-000381-DB-000361<GroupDescription></GroupDescription>SQL6-D0-011800SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).<VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. - -Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79239SV-93945CCI-001814Add the required events to the server audit specification to audit denied actions. -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_ACCESS_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD -(DBCC_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP ); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP ); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO -Determine if an audit is configured to capture denied actions and started by executing the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the following events are included in the server audit specification: - -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, -AUDIT_CHANGE_GROUP, -BACKUP_RESTORE_GROUP, -DATABASE_CHANGE_GROUP, -DATABASE_OBJECT_ACCESS_GROUP, -DATABASE_OBJECT_CHANGE_GROUP, -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, -DATABASE_OWNERSHIP_CHANGE_GROUP, -DATABASE_OPERATION_GROUP, -DATABASE_PERMISSION_CHANGE_GROUP, -DATABASE_PRINCIPAL_CHANGE_GROUP, -DATABASE_PRINCIPAL_IMPERSONATION_GROUP, -DATABASE_ROLE_MEMBER_CHANGE_GROUP, -DBCC_GROUP, -LOGIN_CHANGE_PASSWORD_GROUP, -SCHEMA_OBJECT_CHANGE_GROUP, -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, -SERVER_OBJECT_CHANGE_GROUP, -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP, -SERVER_OBJECT_PERMISSION_CHANGE_GROUP, -SERVER_OPERATION_GROUP, -SERVER_PERMISSION_CHANGE_GROUP, -SERVER_PRINCIPAL_IMPERSONATION_GROUP, -SERVER_ROLE_MEMBER_CHANGE_GROUP, -SERVER_STATE_CHANGE_GROUP, -TRACE_CHANGE_GROUP - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ( -'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', -'AUDIT_CHANGE_GROUP', -'BACKUP_RESTORE_GROUP', -'DATABASE_CHANGE_GROUP', -'DATABASE_OBJECT_ACCESS_GROUP', -'DATABASE_OBJECT_CHANGE_GROUP', -'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', -'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', -'DATABASE_OWNERSHIP_CHANGE_GROUP', -'DATABASE_OPERATION_GROUP', -'DATABASE_OWNERSHIP_CHANGE_GROUP', -'DATABASE_PERMISSION_CHANGE_GROUP', -'DATABASE_PRINCIPAL_CHANGE_GROUP', -'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', -'DATABASE_ROLE_MEMBER_CHANGE_GROUP', -'DBCC_GROUP', -'LOGIN_CHANGE_PASSWORD_GROUP', -'SCHEMA_OBJECT_CHANGE_GROUP', -'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', -'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', -'SERVER_OBJECT_CHANGE_GROUP', -'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', -'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', -'SERVER_OPERATION_GROUP', -'SERVER_PERMISSION_CHANGE_GROUP', -'SERVER_PRINCIPAL_IMPERSONATION_GROUP', -'SERVER_ROLE_MEMBER_CHANGE_GROUP', -'SERVER_STATE_CHANGE_GROUP', -'TRACE_CHANGE_GROUP' -) -Order by d.audit_action_name - -If the identified groups are not returned, this is a finding. -SRG-APP-000383-DB-000364<GroupDescription></GroupDescription>SQL6-D0-011900SQL Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.<VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93947V-79241CCI-001762Assign the approved TCP/IP port number to the SQL Server Database Engine. -1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for <instance name>, and then double-click "TCP/IP". -2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. -3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". -4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". -5. In the console pane, click "SQL Server Services". -6. In the details pane, right-click "SQL Server (<instance name>)" and then click "Restart", to stop and restart SQL Server. - -To disable a server network protocol for an instance: -1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. -2. In the console pane, click "Protocols" for <instance name>. -3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". -4. In the console pane, click "SQL Server Services". -5. In the details pane, right-click "SQL Server (<instance name>)", and then click "Restart", to stop and restart the SQL Server service.SQL Server must only use approved network communication libraries, ports, and protocols. - -Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. - -Verify that the protocols are enabled for the instance. - -If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012300SQL Server must maintain a separate execution domain for each executing process.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. - -Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. - -Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93949V-79243CCI-002530Disable CLR support in SQL Server by executing the following query: - -EXEC sp_configure 'clr enabled', 0 -GO - -RECONFIGURE -GOReview the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: - -SELECT name, value, value_in_use -FROM sys.configurations -WHERE name = 'clr enabled' - -If "value_in_use" is a "1" and CLR is not required, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012400SQL Server services must be configured to run under unique dedicated user accounts.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79245SV-93951CCI-002530Configure SQL Server services to have a documented, dedicated account. - -For non-domain servers, consider using virtual service accounts (VSA). See https://msdn.microsoft.com/en-us/library/ms143504.aspx#VA_Desc for more information. - -For standalone, domain-joined servers, consider using managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#MSA for more information. - -For clustered instances, consider using group managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#GMSA or https://blogs.msdn.microsoft.com/markweberblog/2016/05/25/group-managed-service-accounts-gmsa-and-sql-server-2016/ for more information.Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. - -Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. - -If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding.SRG-APP-000454-DB-000389<GroupDescription></GroupDescription>SQL6-D0-012700When updates are applied to SQL Server software, any software components that have been replaced or made unnecessary must be removed.<VulnDiscussion>Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. - -Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. - -A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79247SV-93953CCI-002617Remove all features that are not required.From the server documentation, obtain a listing of required components. - -Generate a listing of components installed on the server. - -Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" - -Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.SRG-APP-000456-DB-000390<GroupDescription></GroupDescription>SQL6-D0-012800Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).<VulnDiscussion>Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. - -Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). - -This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. - -SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79249SV-93955CCI-002605Upgrade SQL Server to the Microsoft-supported version. Institute and adhere to policies and procedures to ensure that patches are consistently applied to SQL Server within the time allowed.Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://support.microsoft.com/en-us/lifecycle?C2=1044 - -Check the SQL Server Version by running the following script: Print @@version - -If the SQL Server version is not shown as supported, this is a finding. - -If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding.SRG-APP-000492-DB-000332<GroupDescription></GroupDescription>SQL6-D0-012900SQL Server must be able to generate audit records when security objects are accessed.<VulnDiscussion>Changes to the security configuration must be tracked. - -This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79251SV-93957CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000492-DB-000333<GroupDescription></GroupDescription>SQL6-D0-013000SQL Server must generate audit records when unsuccessful attempts to access security objects occur.<VulnDiscussion>Changes to the security configuration must be tracked. - -This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79253SV-93959CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_statu - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000344<GroupDescription></GroupDescription>SQL6-D0-013100SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is accessed.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79255SV-93961CCI-000172Deploy an audit to audit when data classifications are retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are retrieved. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000345<GroupDescription></GroupDescription>SQL6-D0-013200SQL Server must generate audit records when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93963V-79257CCI-000172Deploy an audit to audit when data classifications are unsuccessfully retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully retrieved. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000495-DB-000326<GroupDescription></GroupDescription>SQL6-D0-013300SQL Server must generate audit records when privileges/permissions are added.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93965V-79259CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000495-DB-000327<GroupDescription></GroupDescription>SQL6-D0-013400SQL Server must generate audit records when unsuccessful attempts to add privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93967V-79261CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000495-DB-000328<GroupDescription></GroupDescription>SQL6-D0-013500SQL Server must generate audit records when privileges/permissions are modified.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93969V-79263CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000495-DB-000329<GroupDescription></GroupDescription>SQL6-D0-013600SQL Server must generate audit records when unsuccessful attempts to modify privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93971V-79265CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -See the supplemental file "SQL 2016 Audit.sql". - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. -Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -Execute the following query to verify the required audit actions are included in the server audit specification: - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' -,'DATABASE_OWNERSHIP_CHANGE_GROUP' -,'DATABASE_PERMISSION_CHANGE_GROUP' -,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' -,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' -,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' -,'SERVER_PERMISSION_CHANGE_GROUP' -,'SERVER_ROLE_MEMBER_CHANGE_GROUP') - -If the any of the following audit actions are not returned in an active audit, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx -SRG-APP-000496-DB-000334<GroupDescription></GroupDescription>SQL6-D0-013700SQL Server must generate audit records when security objects are modified.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79267SV-93973CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query: - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' - -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000496-DB-000335<GroupDescription></GroupDescription>SQL6-D0-013800SQL Server must generate audit records when unsuccessful attempts to modify security objects occur.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79269SV-93975CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO - -See supplemental script "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query: +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Enable TLS 1.2: + +1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols + a.If the "TLS 1.2" key does not exist, right-click "Protocols" + b.Click New + c.Click Key + d.Type the name "TLS 1.2" -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +2.Navigate to the "TLS 1.2" subkey + a.If the subkey "Client" does not exist, right-click "TLS 1.2" + b.Click New + c.Click Key + d.Type the name "Client" + e.Repeat steps A – D for the "Server" subkey -If no records are returned, this is a finding. +3.Navigate to the "Client" subkey + a.If the value "Enabled" does not exist, right-click on "Client" + b.Click New + c.Click DWORD + d.Enter "Enabled" as the name + e.Repeat steps A-D for the value "DisabledByDefault" -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. +4.Double-click "Enabled" -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' +5.In Value Data, enter "1" -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000346<GroupDescription></GroupDescription>SQL6-D0-013900SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is modified.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. +6.Click OK -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79271SV-93977CCI-000172Deploy an audit to audit when data classifications are modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are modified. +7.Double-click "DisabledByDefault" -If this is not required, this is not a finding. +8.In Value Data, enter "0" -If the documentation does not exist, this is a finding. +9.Click OK -Determine if an audit is configured and started by executing the following query. +10.Repeat steps 3 – 9 for the "Server" subkey + -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +Disable unwanted SSL/TLS protocol versions: -If no records are returned, this is a finding. +1.Navigate to the path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols + a.If the "TLS 1.0" key does not exist, right-click "Protocols" + b.Click New + c.Click Key + d.Type the name "TLS 1.0" -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. +2.Navigate to the "TLS 1.0" subkey + a.If the subkey "Client" does not exist, right-click "TLS 1.0" + b.Click New + c.Click Key + d.Type the name "Client" + e.Repeat steps A – D for the "Server" subkey -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +3.Navigate to the "Client" subkey + a.If the value "Enabled" does not exist, right-click on "Client" + b.Click New + c.Click DWORD + d.Enter "Enabled" as the name + e.Repeat steps A-D for the value "DisabledByDefault" -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000347<GroupDescription></GroupDescription>SQL6-D0-014000SQL Server must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. +4.Double-click "Enabled" -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. +5.In Value Data, enter "0" -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79273SV-93979CCI-000172Deploy an audit to audit when data classifications are unsuccessfully modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully modified. +6.Click OK -If this is not required, this is not a finding. +7.Double-click "DisabledByDefault" -If the documentation does not exist, this is a finding. +8.In Value Data, enter "1" -Determine if an audit is configured and started by executing the following query. +9.Click OK -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +10.Repeat steps 3 – 9 for the "Server" subkey -If no records are returned, this is a finding. +11.Repeat steps 1 – 10 for "TLS 1.1", "SSL 2.0", and "SSL 3.0" + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. +If this key does not exist, this is a Finding. -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000499-DB-000330<GroupDescription></GroupDescription>SQL6-D0-014100SQL Server must generate audit records when privileges/permissions are deleted.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. +SRG-APP-000176-DB-000068<GroupDescription></GroupDescription>SQL6-D0-008400SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.<VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. + +If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where SQL Server-stored private keys are used to authenticate SQL Server to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against SQL Server system and its clients. + +Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. + +All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93903V-79197CCI-000186Enable use of FIPS 140-2 compliant algorithms. + +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options + +Double-click "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing." + +Click Enabled >> Apply.Review system configuration to determine whether FIPS 140-2 support has been enabled. + +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options + +Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. + +If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. + +For more information, see https://support.microsoft.com/en-us/kb/3141890.SRG-APP-000179-DB-000114<GroupDescription></GroupDescription>SQL6-D0-008700SQL Server must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.<VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of SQL Server. + +Applications, including DBMSs, utilizing cryptography are required to use approved NIST FIPS 140-2 validated cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. + +The security functions validated as part of FIPS 140-2 for cryptographic modules are described in FIPS 140-2 Annex A. + +NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93905V-79199CCI-000803In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +In the dialog box that appears, if the radio buttons are active, click "Enabled", and then click "Apply". If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If, in the "Security Setting" column, the value is "Disabled," this is a finding. + +https://support.microsoft.com/en-us/kb/955720SRG-APP-000180-DB-000115<GroupDescription></GroupDescription>SQL6-D0-008800SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).<VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). + +Non-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. + +Accordingly, a risk assessment is used in determining the authentication needs of the organization. + +Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93907V-79201CCI-000804Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. + +Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: + +SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') + +If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. + +If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding. + +If non-organizational users are not uniquely identified and authenticated, this is a finding.SRG-APP-000224-DB-000384<GroupDescription></GroupDescription>SQL6-D0-009200SQL Server must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.<VulnDiscussion>One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. + +The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. + +However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93909V-79203CCI-001188Configure Windows to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsVerify that Windows is configured to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If the Security Setting for this option is "Disabled", this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009500SQL Server must protect the confidentiality and integrity of all information at rest.<VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. + +User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. + +If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93911V-79205CCI-001199Apply appropriate controls to protect the confidentiality and integrity of data on a secondary device. Where encryption is required, this can be done by full-disk encryption or by database encryption. -In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79275SV-93981CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. +To enable database encryption, create a master key, create a database encryption key, and protect it by using mechanisms tied to the master key, and then set encryption on. -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP +Implement physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s).Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. + +If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted. + +If full-disk encryption is being used, this is not a finding. + +If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing: + +SELECT +d.name AS [Database Name], +CASE e.encryption_state +WHEN 0 THEN 'No database encryption key present, no encryption' +WHEN 1 THEN 'Unencrypted' +WHEN 2 THEN 'Encryption in progress' +WHEN 3 THEN 'Encrypted' +WHEN 4 THEN 'Key change in progress' +WHEN 5 THEN 'Decryption in progress' +WHEN 6 THEN 'Protection change in progress' +END AS [Encryption State] +FROM sys.dm_database_encryption_keys e +RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name +WHERE d.name NOT IN ('master','model','msdb') +ORDER BY [Database Name] ; + +For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. + +Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009600The Service Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93913V-79207CCI-001199Document and implement procedures to safely back up and store the Service Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. Also, include provisions to store the key off-site. + +BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file' +ENCRYPTION BY PASSWORD = 'password'; + +As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.Review procedures for, and evidence of backup of, the Server Service Master Key in the System Security Plan. + +If the procedures or evidence does not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL6-D0-009700The Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93915V-79209CCI-001199Document and implement procedures to safely back up and store the Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Master Key. Also, include provisions to store the key off-site. + +BACKUP MASTER KEY TO FILE = 'path_to_file' +ENCRYPTION BY PASSWORD = 'password'; + +As this requires a password, take care to ensure it is not exposed to unauthorized persons or stored as plain text.If the application owner and Authorizing Official have determined that encryption of data at rest is not required, this is not a finding. + +Review procedures for, and evidence of backup of, the Master Key in the System Security Plan. + +If the procedures or evidence does not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Master Key backup, this is a finding.SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009800SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93917V-79211CCI-001090Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. + +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'common criteria compliance enabled', 1; +GO +RECONFIGURE +GOReview system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. + +SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. + +Review the Instance configuration: -See the supplemental file "SQL 2016 Audit.sql". -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000499-DB-000331<GroupDescription></GroupDescription>SQL6-D0-014200SQL Server must generate audit records when unsuccessful attempts to delete privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79277SV-93983CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP +SELECT value_in_use +FROM sys.configurations +WHERE name = 'common criteria compliance enabled' -See the supplemental file "SQL 2016 Audit.sql". +If "value_in_use" is set to "1" this is not a finding. +If "value_in_use" is set to "0" this is a finding. -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000501-DB-000336<GroupDescription></GroupDescription>SQL6-D0-014300SQL Server must generate audit records when security objects are deleted.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79279SV-93985CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO +NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If an exception justifying setting SQL Server Residual Information Protection (RIP) to disabled (value_in_use set to "0") has been documented and approved, then this may be downgraded to a CAT III finding. +SRG-APP-000243-DB-000373<GroupDescription></GroupDescription>SQL6-D0-009900SQL Server must prevent unauthorized and unintended information transfer via shared system resources.<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93919V-79213CCI-001090If IFI is not documented as being required, disable instant file initialization for the instance of SQL Server by removing the SQL Service SID and/or service account from the "Perform volume maintenance tasks" Local Rights Assignment.Review the system documentation to determine if Instant File Initialization (IFI) is required. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +If IFI is documented as required, this is not a finding. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO +Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016). -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment -See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. +If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance: NT SERVICE\MSSQL$InstanceName) has been granted "Perform volume maintenance tasks" Local Rights Assignment and if it is not documented in the system documentation, this is a finding.SRG-APP-000243-DB-000374<GroupDescription></GroupDescription>SQL6-D0-010000Access to database files must be limited to relevant processes and to authorized, administrative users.<VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93921V-79215CCI-001090Remove any unauthorized permission grants from SQL Server data, log, and backup directories. -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +1) On the "Security" tab, highlight the user entry. +2) Click "Remove".Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. -If no records are returned, this is a finding. +To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. +For each of the directories returned by the above script, verify whether the correct permissions have been applied. -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' +1) Launch Windows Explorer. +2) Navigate to the folder. +3) Right-click the folder and click "Properties". +4) Navigate to the "Security" tab. +5) Review the listing of principals and permissions. -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000501-DB-000337<GroupDescription></GroupDescription>SQL6-D0-014400SQL Server must generate audit records when unsuccessful attempts to delete security objects occur.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. +Account Type Directory Type Permission +----------------------------------------------------------------------------------------------- +Database Administrators ALL Full Control +SQL Server Service SID Data; Log; Backup; Full Control +SQL Server Agent Service SID Backup Full Control +SYSTEM ALL Full Control +CREATOR OWNER ALL Full Control -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93987V-79281CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification -USE [master]; -GO +For information on how to determine a "Service SID", go to: +https://aka.ms/sql-service-sids -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: +https://aka.ms/sqlservicepermissions -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -GO +If any additional permissions are granted but not documented as authorized, this is a finding.SRG-APP-000267-DB-000163<GroupDescription></GroupDescription>SQL6-D0-010100SQL Server must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.<VulnDiscussion>If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. + +Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. + +It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93923V-79217CCI-001314Configure audit logging, tracing and/or custom code in the database or application to record detailed error messages generated by SQL Server, for review by authorized personnel. + +If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio. Use the REVOKE or DENY commands to remove them from the security admin or sysadmin roles. + +If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, remove their permissions. + +Consider enabling trace flag 3625 to mask certain system-level error information returned to non-administrative users. + +Launch SQL Server Configuration Manager >> Click SQL Services >> Open the instance properties >> Click the Service Parameters tab >> Enter "-T3625" >> Click Add >> Click OK >> Restart SQL instance.Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. + +SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: + +USE master +GO +SELECT Name +FROM syslogins +WHERE (sysadmin = 1 or securityadmin = 1) +and hasaccess = 1; + +If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. + +In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed. + +If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio, this is a finding.SRG-APP-000340-DB-000304<GroupDescription></GroupDescription>SQL6-D0-010400SQL Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.<VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. + +System documentation should include a definition of the functionality considered privileged. + +Depending on circumstances, privileged functions can include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. + +A privileged function in SQL Server/database context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples include: + +TRUNCATE TABLE; +DELETE, or +DELETE affecting more than n rows, for some n, or +DELETE without a WHERE clause; + +UPDATE or +UPDATE affecting more than n rows, for some n, or +UPDATE without a WHERE clause; + +Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. + +Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93925V-79219CCI-002235Restrict the granting of permissions to server-level securables to only those authorized. Most notably, members of sysadmin and securityadmin built-in instance-level roles, CONTROL SERVER permission, and use of the GRANT with GRANT permission.Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. + +Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. + +Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. + +Get all permission assignments to logins and roles: + +SELECT DISTINCT + CASE + WHEN SP.class_desc IS NOT NULL THEN + CASE + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' + ELSE SP.class_desc + END + WHEN E.name IS NOT NULL THEN 'ENDPOINT' + WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' + WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' + WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' + ELSE '???' + END AS [Securable Class], + CASE + WHEN E.name IS NOT NULL THEN E.name + WHEN S.name IS NOT NULL THEN S.name + WHEN P.name IS NOT NULL THEN P.name + ELSE '???' + END AS [Securable], + P1.name AS [Grantee], + P1.type_desc AS [Grantee Type], + sp.permission_name AS [Permission], + sp.state_desc AS [State], + P2.name AS [Grantor], + P2.type_desc AS [Grantor Type] +FROM + sys.server_permissions SP + INNER JOIN sys.server_principals P1 + ON P1.principal_id = SP.grantee_principal_id + INNER JOIN sys.server_principals P2 + ON P2.principal_id = SP.grantor_principal_id + + FULL OUTER JOIN sys.servers S + ON SP.class_desc = 'SERVER' + AND S.server_id = SP.major_id + + FULL OUTER JOIN sys.endpoints E + ON SP.class_desc = 'ENDPOINT' + AND E.endpoint_id = SP.major_id + + FULL OUTER JOIN sys.server_principals P + ON SP.class_desc = 'SERVER_PRINCIPAL' + AND P.principal_id = SP.major_id + +Get all server role memberships: + +SELECT + R.name AS [Role], + M.name AS [Member] +FROM + sys.server_role_members X + INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id + INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id + +The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) + +Ensure only the documented and approved logins have privileged functions in SQL Server. + +If the current configuration does not match the documented baseline, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-010500Use of credentials and proxies must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. + +Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93927V-79221CCI-002233Remove any SQL Agent Proxy accounts and credentials that are not authorized. + +DROP CREDENTIAL <Credential Name> +GO + +USE [msdb] +EXEC sp_delete_proxy @proxy_name = '<Proxy Name>' +GOReview the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. + +SELECT C.name AS credential_name, C.credential_identity +FROM sys.credentials C +GO + +SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity +FROM sys.credentials C +JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id +WHERE P.enabled = 1 +GO + +If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding.SRG-APP-000356-DB-000314<GroupDescription></GroupDescription>SQL6-D0-010700SQL Server must utilize centralized management of the content captured in audit records generated by all components of SQL Server.<VulnDiscussion>Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. + +The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. + +SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93929V-79223CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. + +If the SQL Server audit records are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000356-DB-000315<GroupDescription></GroupDescription>SQL6-D0-010800SQL Server must provide centralized configuration of the content to be captured in audit records generated by all components of SQL Server.<VulnDiscussion>If the configuration of SQL Server's auditing is spread across multiple locations in the database management software, or across multiple commands, only loosely related, it is harder to use and takes longer to reconfigure in response to events. + +SQL Server must provide a unified tool for audit configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93931V-79225CCI-001844Configure and/or deploy software tools to ensure that SQL Server audit records (to include traces used for audit purposes) are written directly to or systematically transferred to a centralized log management system.Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. + +If the SQL Server audit records (to include traces used for audit purposes) are not written directly to or systematically transferred to a centralized log management system, this is a finding.SRG-APP-000357-DB-000316<GroupDescription></GroupDescription>SQL6-D0-010900SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.<VulnDiscussion>In order to ensure sufficient storage capacity for the audit logs, SQL Server must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. + +The task of allocating audit record storage capacity is usually performed during initial installation of SQL Server and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. + +In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93933V-79227CCI-001849Review the SQL Audit file location, ensure the destination has enough space available to accommodate the maximum total size of all files that could be written. + +Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. + +Update the "max_files" parameter of the audits to ensure the correct number of files is defined.Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. + +SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path" +FROM sys.server_file_audits + +Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. + +If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.SRG-APP-000359-DB-000319<GroupDescription></GroupDescription>SQL6-D0-011000SQL Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.<VulnDiscussion>Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to SQL Server on its own server will not be an issue. However, space will still be required on the server for SQL Server audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. + +If support personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. + +The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. + +Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93935V-79229CCI-001855Utilize operating system alerting mechanisms, SQL Agent, Operations Management tools, and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75%.The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. + +If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding.SRG-APP-000360-DB-000320<GroupDescription></GroupDescription>SQL6-D0-011100SQL Server must provide an immediate real-time alert to appropriate support staff of all audit log failures.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. + +The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO +A failure of database auditing will result in either the database continuing to function without auditing or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions -See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. +Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93937V-79231CCI-001858Configure the system to provide immediate real-time alerts to appropriate support staff when an audit log failure occurs.Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. + +If real-time alerts are not sent upon auditing failure, this is a finding.SRG-APP-000374-DB-000322<GroupDescription></GroupDescription>SQL6-D0-011200SQL Server must record time stamps in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).<VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. + +Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93939V-79233CCI-001890Where possible, configure the operating system to automatic synchronize with an official time server, using NTP. + +Where there is reason not to implement automatic synchronization with an official time server, using NTP, document the reason, and the procedure for maintaining the correct time, and obtain AO approval. Enforce the procedure.SQL Server audits store the timestamp in UTC time. + +Determine if the computer is joined to a domain. + +SELECT DEFAULT_DOMAIN()[DomainName] + +If this is not NULL, this is not a finding. + +If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) + + w32tm /query /source + +If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding. + +If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system. + +If such a procedure does not exist, this is a finding. + +If the procedure exists, review evidence that the correct time is actually maintained. + +If the evidence indicates otherwise, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011400SQL Server must enforce access restrictions associated with changes to the configuration of the instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. + +When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93941V-79235CCI-001813Revoke unauthorized permissions from principals. + +https://msdn.microsoft.com/en-us/library/ms186308.aspx + +Remove unauthorized logins from roles. + +ALTER SERVER ROLE DROP MEMBER login; + +https://technet.microsoft.com/en-us/library/ee677634.aspxObtain a list of logins who have privileged permissions and role memberships in SQL. + +Execute the following query to obtain a list of logins and roles and their respective permissions assignment: + +SELECT p.name AS Principal, +p.type_desc AS Type, +sp.permission_name AS Permission, +sp.state_desc AS State +FROM sys.server_principals p +INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id +WHERE sp.permission_name = 'CONTROL SERVER' +OR sp.state = 'W' + +Execute the following query to obtain a list of logins and their role memberships. + +SELECT m.name AS Member, +m.type_desc AS Type, +r.name AS Role +FROM sys.server_principals m +INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id +INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id +WHERE r.name IN ('sysadmin','securityadmin','serveradmin') + +Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding.SRG-APP-000380-DB-000360<GroupDescription></GroupDescription>SQL6-D0-011500Windows must enforce access restrictions associated with changes to the configuration of the SQL Server instance.<VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. + +When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93943V-79237CCI-001813Remove users from the local Administrators group who are not authorized.Obtain a list of users who have privileged access to the server via the local Administrators group. + +Launch lusrmgr.msc +Select Groups +Double-click Administrators + +Alternatively, execute the following command in PowerShell: + +net localgroup administrators + +Check the server documentation to verify the users returned are authorized. + +If the users are not documented and authorized, this is a finding.SRG-APP-000381-DB-000361<GroupDescription></GroupDescription>SQL6-D0-011800SQL Server must produce audit records of its enforcement of access restrictions associated with changes to the configuration of SQL Server or database(s).<VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. + +Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93945V-79239CCI-001814Add the required events to the server audit specification to audit denied actions. +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_ACCESS_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD +(DBCC_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP ); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP ); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO +Determine if an audit is configured to capture denied actions and started by executing the following query: SELECT name AS 'Audit Name', status_desc AS 'Audit Status', @@ -2636,7 +1852,36 @@ FROM sys.dm_server_audit_status If no records are returned, this is a finding. -Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, +AUDIT_CHANGE_GROUP, +BACKUP_RESTORE_GROUP, +DATABASE_CHANGE_GROUP, +DATABASE_OBJECT_ACCESS_GROUP, +DATABASE_OBJECT_CHANGE_GROUP, +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, +DATABASE_OWNERSHIP_CHANGE_GROUP, +DATABASE_OPERATION_GROUP, +DATABASE_PERMISSION_CHANGE_GROUP, +DATABASE_PRINCIPAL_CHANGE_GROUP, +DATABASE_PRINCIPAL_IMPERSONATION_GROUP, +DATABASE_ROLE_MEMBER_CHANGE_GROUP, +DBCC_GROUP, +LOGIN_CHANGE_PASSWORD_GROUP, +SCHEMA_OBJECT_CHANGE_GROUP, +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, +SERVER_OBJECT_CHANGE_GROUP, +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP, +SERVER_OBJECT_PERMISSION_CHANGE_GROUP, +SERVER_OPERATION_GROUP, +SERVER_PERMISSION_CHANGE_GROUP, +SERVER_PRINCIPAL_IMPERSONATION_GROUP, +SERVER_ROLE_MEMBER_CHANGE_GROUP, +SERVER_STATE_CHANGE_GROUP, +TRACE_CHANGE_GROUP SELECT a.name AS 'AuditName', s.name AS 'SpecName', @@ -2645,41 +1890,175 @@ d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' - -If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000348<GroupDescription></GroupDescription>SQL6-D0-014500SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is deleted.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93989V-79283CCI-000172Deploy an audit to audit when data classifications are deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are deleted. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ( +'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', +'AUDIT_CHANGE_GROUP', +'BACKUP_RESTORE_GROUP', +'DATABASE_CHANGE_GROUP', +'DATABASE_OBJECT_ACCESS_GROUP', +'DATABASE_OBJECT_CHANGE_GROUP', +'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', +'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', +'DATABASE_OWNERSHIP_CHANGE_GROUP', +'DATABASE_OPERATION_GROUP', +'DATABASE_PERMISSION_CHANGE_GROUP', +'DATABASE_PRINCIPAL_CHANGE_GROUP', +'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', +'DATABASE_ROLE_MEMBER_CHANGE_GROUP', +'DBCC_GROUP', +'LOGIN_CHANGE_PASSWORD_GROUP', +'SCHEMA_OBJECT_CHANGE_GROUP', +'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', +'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', +'SERVER_OBJECT_CHANGE_GROUP', +'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', +'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', +'SERVER_OPERATION_GROUP', +'SERVER_PERMISSION_CHANGE_GROUP', +'SERVER_PRINCIPAL_IMPERSONATION_GROUP', +'SERVER_ROLE_MEMBER_CHANGE_GROUP', +'SERVER_STATE_CHANGE_GROUP', +'TRACE_CHANGE_GROUP' +) +Order by d.audit_action_name -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' +If the identified groups are not returned, this is a finding.SRG-APP-000383-DB-000364<GroupDescription></GroupDescription>SQL6-D0-011900SQL Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.<VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93947V-79241CCI-001762Assign the approved TCP/IP port number to the SQL Server Database Engine. +1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration, expand Protocols for <instance name>, and then double-click "TCP/IP". +2. In the "TCP/IP Properties" dialog box, on the "IP Addresses" tab, several IP addresses appear in the format IP1, IP2, up to IPAll. One of these is for the IP address of the loopback adapter, 127.0.0.1. Additional IP addresses appear for each IP Address on the computer. (You will probably see both IP version 4 and IP version 6 addresses.) Right-click each address, and then click "Properties" to identify the IP address that you want to configure. +3. If the "TCP Dynamic Ports" dialog box contains "0", indicating the Database Engine is listening on dynamic ports, delete the "0". +4. In the "IPn Properties area" box, in the "TCP Port" box, type the port number you want this IP address to listen on, and then click "OK". +5. In the console pane, click "SQL Server Services". +6. In the details pane, right-click "SQL Server (<instance name>)" and then click "Restart", to stop and restart SQL Server. + +To disable a server network protocol for an instance: +1. In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. +2. In the console pane, click "Protocols" for <instance name>. +3. In the details pane, right-click the protocol you want to change, and then click "Enable" or "Disable". +4. In the console pane, click "SQL Server Services". +5. In the details pane, right-click "SQL Server (<instance name>)", and then click "Restart", to stop and restart the SQL Server service.SQL Server must only use approved network communication libraries, ports, and protocols. + +Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. + +Verify that the protocols are enabled for the instance. + +If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012300SQL Server must maintain a separate execution domain for each executing process.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. + +Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. + +Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93949V-79243CCI-002530Disable CLR support in SQL Server by executing the following query: + +EXEC sp_configure 'clr enabled', 0 +GO + +RECONFIGURE +GOReview the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: + +SELECT name, value, value_in_use +FROM sys.configurations +WHERE name = 'clr enabled' + +If "value_in_use" is a "1" and CLR is not required, this is a finding.SRG-APP-000431-DB-000388<GroupDescription></GroupDescription>SQL6-D0-012400SQL Server services must be configured to run under unique dedicated user accounts.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93951V-79245CCI-002530Configure SQL Server services to have a documented, dedicated account. + +For non-domain servers, consider using virtual service accounts (VSA). See https://msdn.microsoft.com/en-us/library/ms143504.aspx#VA_Desc for more information. + +For standalone, domain-joined servers, consider using managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#MSA for more information. + +For clustered instances, consider using group managed service accounts. See https://msdn.microsoft.com/en-us/library/ms143504.aspx#GMSA or https://blogs.msdn.microsoft.com/markweberblog/2016/05/25/group-managed-service-accounts-gmsa-and-sql-server-2016/ for more information.Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. + +Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. + +If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding.SRG-APP-000454-DB-000389<GroupDescription></GroupDescription>SQL6-D0-012700When updates are applied to SQL Server software, any software components that have been replaced or made unnecessary must be removed.<VulnDiscussion>Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. + +Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. + +A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93953V-79247CCI-002617Remove all features that are not required.From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.SRG-APP-000456-DB-000390<GroupDescription></GroupDescription>SQL6-D0-012800Security-relevant software updates to SQL Server must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).<VulnDiscussion>Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + +Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). + +This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. + +SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93955V-79249CCI-002605Upgrade SQL Server to the Microsoft-supported version. Institute and adhere to policies and procedures to ensure that patches are consistently applied to SQL Server within the time allowed.Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://support.microsoft.com/en-us/lifecycle?C2=1044 + +Check the SQL Server Version by running the following script: Print @@version + +If the SQL Server version is not shown as supported, this is a finding. + +If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding.SRG-APP-000492-DB-000332<GroupDescription></GroupDescription>SQL6-D0-012900SQL Server must be able to generate audit records when security objects are accessed.<VulnDiscussion>Changes to the security configuration must be tracked. + +This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93957V-79251CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000349<GroupDescription></GroupDescription>SQL6-D0-014600SQL Server must generate audit records when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. - -For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93991V-79285CCI-000172Deploy an audit to audit when data classifications are unsuccessfully deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully deleted. +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000492-DB-000333<GroupDescription></GroupDescription>SQL6-D0-013000SQL Server must generate audit records when unsuccessful attempts to access security objects occur.<VulnDiscussion>Changes to the security configuration must be tracked. + +This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93959V-79253CCI-000172Deploy an audit to audit the retrieval of privilege/permission/role membership information. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_statu + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000344<GroupDescription></GroupDescription>SQL6-D0-013100SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is accessed.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93961V-79255CCI-000172Deploy an audit to audit when data classifications are retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are retrieved. If this is not required, this is not a finding. @@ -2688,323 +2067,942 @@ If the documentation does not exist, this is a finding. Determine if an audit is configured and started by executing the following query. SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status If no records are returned, this is a finding. -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. +If auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' FROM sys.server_audit_specifications s JOIN sys.server_audits a ON s.audit_guid = a.audit_guid JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000503-DB-000350<GroupDescription></GroupDescription>SQL6-D0-014700SQL Server must generate audit records when successful logons or connections occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79287SV-93993CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO - -Alternatively, enable "Both failed and successful logins" -In SQL Management Studio -Right-click on the instance ->> Select "Properties" ->> Select "Security" on the left hand side ->> Select "Both failed and successful logins" ->> Click "OK"Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000494-DB-000345<GroupDescription></GroupDescription>SQL6-D0-013200SQL Server must generate audit records when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93963V-79257CCI-000172Deploy an audit to audit when data classifications are unsuccessfully retrieved. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully retrieved. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000495-DB-000326<GroupDescription></GroupDescription>SQL6-D0-013300SQL Server must generate audit records when privileges/permissions are added.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93965V-79259CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status -Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP is included in the server audit specification. +Execute the following query to verify the required audit actions are included in the server audit specification: -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' - -If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. - -If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. - -In SQL Management Studio -Right-click on the instance ->> Select "Properties" ->> Select "Security" on the left hand side ->> Check the setting for "Login auditing" - -If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000503-DB-000351<GroupDescription></GroupDescription>SQL6-D0-014800SQL Server must generate audit records when unsuccessful logons or connection attempts occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79289SV-93995CCI-000172Add the "FAILED_LOGIN_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (FAILED_LOGIN_GROUP); -GO +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query. +If the any of the following audit actions are not returned in an active audit, this is a finding. -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000495-DB-000327<GroupDescription></GroupDescription>SQL6-D0-013400SQL Server must generate audit records when unsuccessful attempts to add privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93967V-79261CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status -If no records are returned, this is a finding. - -Execute the following query to verify the "FAILED_LOGIN_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' - -If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000504-DB-000354<GroupDescription></GroupDescription>SQL6-D0-014900SQL Server must generate audit records for all privileged activities or other system-level access.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. - -System documentation should include a definition of the functionality considered privileged. - -A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: -CREATE -ALTER -DROP -GRANT -REVOKE -DENY - -There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples in SQL include: - -TRUNCATE TABLE; -DELETE, or -DELETE affecting more than n rows, for some n, or -DELETE without a WHERE clause; - -UPDATE or -UPDATE affecting more than n rows, for some n, or -UPDATE without a WHERE clause; - -any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. - -Depending on the capabilities of SQL Server and the design of the database and associated applications, audit logging may be achieved by means of DBMS auditing features, database triggers, other mechanisms, or a combination of these. - -Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79291SV-93997CCI-000172Add the required events to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query: +Execute the following query to verify the required audit actions are included in the server audit specification: -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -If no records are returned, this is a finding. +If the any of the following audit actions are not returned in an active audit, this is a finding. -Execute the following query to verify the following events are included in the server audit specification: +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000495-DB-000328<GroupDescription></GroupDescription>SQL6-D0-013500SQL Server must generate audit records when privileges/permissions are modified.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93969V-79263CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP -AUDIT_CHANGE_GROUP -BACKUP_RESTORE_GROUP -DATABASE_CHANGE_GROUP -DATABASE_OBJECT_CHANGE_GROUP -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OPERATION_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_PRINCIPAL_CHANGE_GROUP -DATABASE_PRINCIPAL_IMPERSONATION_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -DBCC_GROUP -LOGIN_CHANGE_PASSWORD_GROUP -SCHEMA_OBJECT_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OPERATION_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_PRINCIPAL_CHANGE_GROUP -SERVER_PRINCIPAL_IMPERSONATION_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP -SERVER_STATE_CHANGE_GROUP -TRACE_CHANGE_GROUP -USER_CHANGE_PASSWORD_GROUP +Execute the following query to verify the required audit actions are included in the server audit specification: -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id WHERE a.is_state_enabled = 1 -AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') - -If the identified groups are not returned, this is a finding.SRG-APP-000504-DB-000355<GroupDescription></GroupDescription>SQL6-D0-015000SQL Server must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. - -System documentation should include a definition of the functionality considered privileged. - -A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: -CREATE -ALTER -DROP -GRANT -REVOKE -DENY +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity. +If the any of the following audit actions are not returned in an active audit, this is a finding. -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79293SV-93999CCI-000172Add the required events to the server audit specification -USE [master]; -GO -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); -GO +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000495-DB-000329<GroupDescription></GroupDescription>SQL6-D0-013600SQL Server must generate audit records when unsuccessful attempts to modify privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93971V-79265CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO -Determine if an audit is configured and started by executing the following query. +Execute the following query to verify the required audit actions are included in the server audit specification: -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') -If no records are returned, this is a finding. +If the any of the following audit actions are not returned in an active audit, this is a finding. -Execute the following query to verify the following events are included in the server audit specification: +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx +SRG-APP-000496-DB-000334<GroupDescription></GroupDescription>SQL6-D0-013700SQL Server must generate audit records when security objects are modified.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93973V-79267CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000496-DB-000335<GroupDescription></GroupDescription>SQL6-D0-013800SQL Server must generate audit records when unsuccessful attempts to modify security objects occur.<VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93975V-79269CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +See supplemental script "SQL 2016 Audit.sql".Determine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000346<GroupDescription></GroupDescription>SQL6-D0-013900SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is modified.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93977V-79271CCI-000172Deploy an audit to audit when data classifications are modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are modified. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000498-DB-000347<GroupDescription></GroupDescription>SQL6-D0-014000SQL Server must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93979V-79273CCI-000172Deploy an audit to audit when data classifications are unsuccessfully modified. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully modified. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000499-DB-000330<GroupDescription></GroupDescription>SQL6-D0-014100SQL Server must generate audit records when privileges/permissions are deleted.<VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93981V-79275CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. + +If the following events are not included, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000499-DB-000331<GroupDescription></GroupDescription>SQL6-D0-014200SQL Server must generate audit records when unsuccessful attempts to delete privileges/permissions occur.<VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93983V-79277CCI-000172Add the following events to the SQL Server Audit that is being used for the STIG compliant audit. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +See the supplemental file "SQL 2016 Audit.sql". -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP -AUDIT_CHANGE_GROUP -BACKUP_RESTORE_GROUP -DATABASE_CHANGE_GROUP -DATABASE_OBJECT_CHANGE_GROUP -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OPERATION_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_PRINCIPAL_CHANGE_GROUP -DATABASE_PRINCIPAL_IMPERSONATION_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -DBCC_GROUP +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxCheck the SQL Server Audit being used for the STIG compliant audit. + +If the following events are not included, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspxSRG-APP-000501-DB-000336<GroupDescription></GroupDescription>SQL6-D0-014300SQL Server must generate audit records when security objects are deleted.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93985V-79279CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000501-DB-000337<GroupDescription></GroupDescription>SQL6-D0-014400SQL Server must generate audit records when unsuccessful attempts to delete security objects occur.<VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93987V-79281CCI-000172Add the "SCHEMA_OBJECT_CHANGE_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +See the supplemental script "SQL 2016 Audit.sql" for complete script.Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000348<GroupDescription></GroupDescription>SQL6-D0-014500SQL Server must generate audit records when categorized information (e.g., classification levels/security levels) is deleted.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93989V-79283CCI-000172Deploy an audit to audit when data classifications are deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are deleted. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000502-DB-000349<GroupDescription></GroupDescription>SQL6-D0-014600SQL Server must generate audit records when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur.<VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93991V-79285CCI-000172Deploy an audit to audit when data classifications are unsuccessfully deleted. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully deleted. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000503-DB-000350<GroupDescription></GroupDescription>SQL6-D0-014700SQL Server must generate audit records when successful logons or connections occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93993V-79287CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +Alternatively, enable "Both failed and successful logins" +In SQL Management Studio +Right-click on the instance +>> Select "Properties" +>> Select "Security" on the left hand side +>> Select "Both failed and successful logins" +>> Click "OK"Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' + +If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. + +If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. + +In SQL Management Studio +Right-click on the instance +>> Select "Properties" +>> Select "Security" on the left hand side +>> Check the setting for "Login auditing" + +If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000503-DB-000351<GroupDescription></GroupDescription>SQL6-D0-014800SQL Server must generate audit records when unsuccessful logons or connection attempts occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93995V-79289CCI-000172Add the "FAILED_LOGIN_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (FAILED_LOGIN_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "FAILED_LOGIN_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' + +If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000504-DB-000354<GroupDescription></GroupDescription>SQL6-D0-014900SQL Server must generate audit records for all privileged activities or other system-level access.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +System documentation should include a definition of the functionality considered privileged. + +A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples in SQL include: + +TRUNCATE TABLE; +DELETE, or +DELETE affecting more than n rows, for some n, or +DELETE without a WHERE clause; + +UPDATE or +UPDATE affecting more than n rows, for some n, or +UPDATE without a WHERE clause; + +any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. + +Depending on the capabilities of SQL Server and the design of the database and associated applications, audit logging may be achieved by means of DBMS auditing features, database triggers, other mechanisms, or a combination of these. + +Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93997V-79291CCI-000172Add the required events to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP +LOGIN_CHANGE_PASSWORD_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') + +If the identified groups are not returned, this is a finding.SRG-APP-000504-DB-000355<GroupDescription></GroupDescription>SQL6-D0-015000SQL Server must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +System documentation should include a definition of the functionality considered privileged. + +A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-93999V-79293CCI-000172Add the required events to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (AUDIT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (BACKUP_RESTORE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (DBCC_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGIN_CHANGE_PASSWORD_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_OPERATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PERMISSION_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SERVER_STATE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (TRACE_CHANGE_GROUP); +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (USER_CHANGE_PASSWORD_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP -LOGOUT_GROUP -SCHEMA_OBJECT_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OPERATION_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_PRINCIPAL_CHANGE_GROUP -SERVER_PRINCIPAL_IMPERSONATION_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP -SERVER_STATE_CHANGE_GROUP -TRACE_CHANGE_GROUP -USER_CHANGE_PASSWORD_GROUP - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 +LOGOUT_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', @@ -3041,69 +3039,69 @@ Order by d.audit_action_name If the identified groups are not returned, this is a finding. -SRG-APP-000505-DB-000352<GroupDescription></GroupDescription>SQL6-D0-015100SQL Server must generate audit records showing starting and ending time for user access to the database(s).<VulnDiscussion>For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. - -Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79295SV-94001CCI-000172Add the "LOGOUT_GROUP" to the server audit specification -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GODetermine if an audit is configured and started by executing the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the following events are included in the server audit specification: - -APPLICATION_ROLE_CHANGE_PASSWORD_GROUP -AUDIT_CHANGE_GROUP -BACKUP_RESTORE_GROUP -DATABASE_CHANGE_GROUP -DATABASE_OBJECT_CHANGE_GROUP -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OPERATION_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_PRINCIPAL_CHANGE_GROUP -DATABASE_PRINCIPAL_IMPERSONATION_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -DBCC_GROUP +SRG-APP-000505-DB-000352<GroupDescription></GroupDescription>SQL6-D0-015100SQL Server must generate audit records showing starting and ending time for user access to the database(s).<VulnDiscussion>For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. + +Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94001V-79295CCI-000172Add the "LOGOUT_GROUP" to the server audit specification +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GODetermine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP LOGIN_CHANGE_PASSWORD_GROUP -LOGOUT_GROUP -SCHEMA_OBJECT_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OPERATION_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_PRINCIPAL_CHANGE_GROUP -SERVER_PRINCIPAL_IMPERSONATION_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP -SERVER_STATE_CHANGE_GROUP -TRACE_CHANGE_GROUP -USER_CHANGE_PASSWORD_GROUP - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 +LOGOUT_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', 'AUDIT_CHANGE_GROUP', 'BACKUP_RESTORE_GROUP', @@ -3140,250 +3138,250 @@ Order by d.audit_action_name If the identified groups are not returned, this is a finding. -SRG-APP-000506-DB-000353<GroupDescription></GroupDescription>SQL6-D0-015200SQL Server must generate audit records when concurrent logons/connections by the same user from different workstations occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. - -Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised. - -(If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79297SV-94003CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. -USE [master]; -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); -GO - -ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); -GO - -Alternatively, enable "Both failed and successful logins" -In SQL Management Studio: -Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Select "Both failed and successful logins" >> Click "OK"Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -Execute the following query to verify the "SUCCESSFUL_LOGIN_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', -s.name AS 'SpecName', -d.audit_action_name AS 'ActionName', -d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' - -If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. - -If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. - -In SQL Management Studio: -Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" - -If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000507-DB-000356<GroupDescription></GroupDescription>SQL6-D0-015300SQL Server must generate audit records when successful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94005V-79299CCI-000172Deploy an audit to audit when successful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when successful accesses to objects occur. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000507-DB-000357<GroupDescription></GroupDescription>SQL6-D0-015400SQL Server must generate audit records when unsuccessful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. - -In an SQL environment, types of access include, but are not necessarily limited to: -SELECT -INSERT -UPDATE -DELETE -EXECUTE - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94007V-79301CCI-000172Deploy an audit to audit when unsuccessful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when unsuccessful accesses to objects occur. - -If this is not required, this is not a finding. - -If the documentation does not exist, this is a finding. - -Determine if an audit is configured and started by executing the following query. - -SELECT name AS 'Audit Name', - status_desc AS 'Audit Status', - audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status - -If no records are returned, this is a finding. - -If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. - -SELECT a.name AS 'AuditName', - s.name AS 'SpecName', - d.audit_action_name AS 'ActionName', - d.audited_result AS 'Result' -FROM sys.server_audit_specifications s -JOIN sys.server_audits a ON s.audit_guid = a.audit_guid -JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id -WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' - -If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000508-DB-000358<GroupDescription></GroupDescription>SQL6-D0-015500SQL Server must generate audit records for all direct access to the database(s).<VulnDiscussion>In this context, direct access is any query, command, or call to SQL Server that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and non-standard sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94009V-79303CCI-000172Check the system documentation for required SQL Server Audits. Remove any Audit filters that exclude or reduce required auditing. Update filters to ensure administrative activity is not excluded.Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: - -SELECT name AS AuditName, predicate AS AuditFilter -FROM sys.server_audits -WHERE predicate IS NOT NULL - -If any audits are returned, review the associated filters to determine whether administrative activities are being excluded. - -If any audits are configured to exclude administrative activities, this is a finding.SRG-APP-000514-DB-000381<GroupDescription></GroupDescription>SQL6-D0-015600SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. - -For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94011V-79305CCI-002450In Windows, open Administrative Tools >> Local Security Policy. - -Expand Local Policies >> Security Options. - -In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing."Verify that Windows is configured to require the use of FIPS compliant algorithms. - -Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." - -If the Security Setting for this option is "Disabled" this is a finding.SRG-APP-000514-DB-000382<GroupDescription></GroupDescription>SQL6-D0-015700SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. - -For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94013V-79307CCI-002450Configure Windows to require the use of FIPS compliant algorithms. - +SRG-APP-000506-DB-000353<GroupDescription></GroupDescription>SQL6-D0-015200SQL Server must generate audit records when concurrent logons/connections by the same user from different workstations occur.<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. + +Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised. + +(If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94003V-79297CCI-000172Add the "SUCCESSFUL_LOGIN_GROUP" to the server audit specification. +USE [master]; +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (SUCCESSFUL_LOGIN_GROUP); +GO + +ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON); +GO + +Alternatively, enable "Both failed and successful logins" +In SQL Management Studio: +Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Select "Both failed and successful logins" >> Click "OK"Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SUCCESSFUL_LOGIN_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' + +If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. + +If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. + +In SQL Management Studio: +Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" + +If "Both failed and successful logins" is not selected, this is a finding.SRG-APP-000507-DB-000356<GroupDescription></GroupDescription>SQL6-D0-015300SQL Server must generate audit records when successful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94005V-79299CCI-000172Deploy an audit to audit when successful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when successful accesses to objects occur. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000507-DB-000357<GroupDescription></GroupDescription>SQL6-D0-015400SQL Server must generate audit records when unsuccessful accesses to objects occur.<VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94007V-79301CCI-000172Deploy an audit to audit when unsuccessful accesses to objects occur. See the supplemental file "SQL 2016 Audit.sql".Review the system documentation to determine if SQL Server is required to audit when unsuccessful accesses to objects occur. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding.SRG-APP-000508-DB-000358<GroupDescription></GroupDescription>SQL6-D0-015500SQL Server must generate audit records for all direct access to the database(s).<VulnDiscussion>In this context, direct access is any query, command, or call to SQL Server that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and non-standard sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94009V-79303CCI-000172Check the system documentation for required SQL Server Audits. Remove any Audit filters that exclude or reduce required auditing. Update filters to ensure administrative activity is not excluded.Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: + +SELECT name AS AuditName, predicate AS AuditFilter +FROM sys.server_audits +WHERE predicate IS NOT NULL + +If any audits are returned, review the associated filters to determine whether administrative activities are being excluded. + +If any audits are configured to exclude administrative activities, this is a finding.SRG-APP-000514-DB-000381<GroupDescription></GroupDescription>SQL6-D0-015600SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94011V-79305CCI-002450In Windows, open Administrative Tools >> Local Security Policy. + +Expand Local Policies >> Security Options. + +In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing."Verify that Windows is configured to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If the Security Setting for this option is "Disabled" this is a finding.SRG-APP-000514-DB-000382<GroupDescription></GroupDescription>SQL6-D0-015700SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94013V-79307CCI-002450Configure Windows to require the use of FIPS compliant algorithms. + Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsVerify that Windows is configured to require the use of FIPS 140-2 algorithms. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." -If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000514-DB-000383<GroupDescription></GroupDescription>SQL6-D0-015800SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. - -It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. - -For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79309SV-94015CCI-002450Configure Windows to require the use of FIPS compliant algorithms for the unclassified information that requires it. - +If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000514-DB-000383<GroupDescription></GroupDescription>SQL6-D0-015800SQL Server must implement NIST FIPS 140-2 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94015V-79309CCI-002450Configure Windows to require the use of FIPS compliant algorithms for the unclassified information that requires it. + Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." >> Change the Setting option to "Enabled" >> Restart WindowsReview the server documentation, if this system does not contain data that must be encrypted, this finding is NA. Verify that Windows is configured to require the use of FIPS 140-2 algorithms for the unclassified information that requires it. Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." -If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000515-DB-000318<GroupDescription></GroupDescription>SQL6-D0-015900The system SQL Server must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. - -Off-loading is a common process in information systems with limited audit storage capacity. - -The system SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79311SV-94017CCI-001851Configure the system or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.Review the system documentation for a description of how audit records are off-loaded. - -If the system has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. - -If the system does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016000SQL Server must configure Customer Feedback and Error Reporting.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79313SV-94019CCI-000366To disable participation in the CEIP program, change the value of the following registry keys to zero (0). - -To enable participation in the CEIP program, change the value of the following registry keys to one (1). - -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\CustomerFeedback -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\EnableErrorReporting -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\CustomerFeedback -HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\EnableErrorReportingLaunch "Registry Editor" - -Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE -Review the following values: CustomerFeedback, EnableErrorReporting - -Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130 -Review the following values: CustomerFeedback, EnableErrorReporting - -If this is a classified system, and any of the above values are not zero (0), this is a finding. - -If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized. - -If CEIP participation is not authorized, and any of the above values are one (1), this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016100SQL Server must configure SQL Server Usage and Error Reporting Auditing.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs. The Local Audit component of SQL Server Usage Feedback collection writes data collected by the service to a designated folder, representing the data (logs) that will be sent to Microsoft. The purpose of the Local Audit is to allow customers to see all data Microsoft collects with this feature, for compliance, regulatory or privacy validation reasons.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79315SV-94021CCI-000366Configure the instance to audit telemetry data. More information about auditing telemetry data can be found at https://msdn.microsoft.com/en-us/library/mt743085.aspx. - -Create a folder to store the telemetry audit data in. - -Grant the SQLTELEMETRY service the following permissions on the folder: - -- List folder contents -- Read -- Write - -Create and configure the following registry key: -Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) - -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory [string] - -Set the "UserRequestedLocalAuditDirectory" key value to the path of the telemetry audit folder. - -Set the telemetry service to start automatically. Restart the service. -- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). -- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>).Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. - -If auditing of telemetry data is required, determine the telemetry service user name by executing the following query: - -SELECT name -FROM sys.server_principals -WHERE name LIKE '%SQLTELEMETRY%' - -Review the values of the following registry key: -Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) - -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory - -If the registry key do not exist or the value is blank, this is a finding. - -Navigate the path defined in the "UserRequestedLocalAuditDirectory" registry key in file explorer. - -Right-click on the folder and choose "Properties". +If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.SRG-APP-000515-DB-000318<GroupDescription></GroupDescription>SQL6-D0-015900The system SQL Server must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. + +Off-loading is a common process in information systems with limited audit storage capacity. + +The system SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94017V-79311CCI-001851Configure the system or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.Review the system documentation for a description of how audit records are off-loaded. + +If the system has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. + +If the system does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016000SQL Server must configure Customer Feedback and Error Reporting.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94019V-79313CCI-000366To disable participation in the CEIP program, change the value of the following registry keys to zero (0). + +To enable participation in the CEIP program, change the value of the following registry keys to one (1). + +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\CustomerFeedback +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\EnableErrorReporting +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\CustomerFeedback +HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130\EnableErrorReportingLaunch "Registry Editor" + +Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE +Review the following values: CustomerFeedback, EnableErrorReporting + +Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130 +Review the following values: CustomerFeedback, EnableErrorReporting + +If this is a classified system, and any of the above values are not zero (0), this is a finding. + +If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized. + +If CEIP participation is not authorized, and any of the above values are one (1), this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016100SQL Server must configure SQL Server Usage and Error Reporting Auditing.<VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs. The Local Audit component of SQL Server Usage Feedback collection writes data collected by the service to a designated folder, representing the data (logs) that will be sent to Microsoft. The purpose of the Local Audit is to allow customers to see all data Microsoft collects with this feature, for compliance, regulatory or privacy validation reasons.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94021V-79315CCI-000366Configure the instance to audit telemetry data. More information about auditing telemetry data can be found at https://msdn.microsoft.com/en-us/library/mt743085.aspx. + +Create a folder to store the telemetry audit data in. + +Grant the SQLTELEMETRY service the following permissions on the folder: + +- List folder contents +- Read +- Write + +Create and configure the following registry key: +Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory [string] + +Set the "UserRequestedLocalAuditDirectory" key value to the path of the telemetry audit folder. + +Set the telemetry service to start automatically. Restart the service. +- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). +- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>).Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. + +If auditing of telemetry data is required, determine the telemetry service user name by executing the following query: + +SELECT name +FROM sys.server_principals +WHERE name LIKE '%SQLTELEMETRY%' + +Review the values of the following registry key: +Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory + +If the registry key do not exist or the value is blank, this is a finding. + +Navigate the path defined in the "UserRequestedLocalAuditDirectory" registry key in file explorer. + +Right-click on the folder and choose "Properties". Open the "Security" tab. - -Verify the SQLTELEMETRY account has the following permissions: - -- List folder contents -- Read -- Write - -If the permissions are not set properly on the folder, this is a finding. - -Open services.msc and find the telemetry service. -- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). -- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>). - -Right-click on the service and choose "Properties". Verify the "Startup type" is "Automatic." - -If the service is not configured to automatically start, this is a finding. - -Review the processes and procedures for reviewing the telemetry data. If there is evidence that the telemetry data is periodically reviewed in accordance with the processes and procedures, this is not a finding. - -If no processes and procedures exist for reviewing telemetry data, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-016200The SQL Server default account [sa] must be disabled.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. - -This [sa] default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server. If the [sa] default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the [sa] account. - -Some applications that run on SQL Server require the [sa] account to be enabled in order for the application to function properly. These applications that require the [sa] account to be enabled are usually legacy systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79317SV-94023CCI-000213Modify the enabled flag of SQL Server's [sa] (system administrator) account by running the following script. -USE master; -GO -ALTER LOGIN [sa] DISABLE; + +Verify the SQLTELEMETRY account has the following permissions: + +- List folder contents +- Read +- Write + +If the permissions are not set properly on the folder, this is a finding. + +Open services.msc and find the telemetry service. +- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). +- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>). + +Right-click on the service and choose "Properties". Verify the "Startup type" is "Automatic." + +If the service is not configured to automatically start, this is a finding. + +Review the processes and procedures for reviewing the telemetry data. If there is evidence that the telemetry data is periodically reviewed in accordance with the processes and procedures, this is not a finding. + +If no processes and procedures exist for reviewing telemetry data, this is a finding.SRG-APP-000033-DB-000084<GroupDescription></GroupDescription>SQL6-D0-016200The SQL Server default account [sa] must be disabled.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. + +This [sa] default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server. If the [sa] default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the [sa] account. + +Some applications that run on SQL Server require the [sa] account to be enabled in order for the application to function properly. These applications that require the [sa] account to be enabled are usually legacy systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94023V-79317CCI-000213Modify the enabled flag of SQL Server's [sa] (system administrator) account by running the following script. +USE master; +GO +ALTER LOGIN [sa] DISABLE; GOCheck SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: USE master; @@ -3395,25 +3393,25 @@ GO Verify that the "name" column contains the current name of the [sa] database server account. -If the "is_disabled" column is not set to “1”, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-016300SQL Server default account [sa] must have its name changed.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. +If the "is_disabled" column is not set to “1”, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-016300SQL Server default account [sa] must have its name changed.<VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. -Since the SQL Server [sa] is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the [sa] account name.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79319SV-94025CCI-000381Modify the SQL Server's [sa] (system administrator) account by running the following script: +Since the SQL Server [sa] is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the [sa] account name.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94025V-79319CCI-000381Modify the SQL Server's [sa] (system administrator) account by running the following script: -USE master; -GO -ALTER LOGIN [sa] WITH NAME = <new name> -GOVerify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: +USE master; +GO +ALTER LOGIN [sa] WITH NAME = <new name> +GOVerify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: -USE master; -GO -SELECT * -FROM sys.sql_logins -WHERE [name] = 'sa' OR [principal_id] = 1; -GO +USE master; +GO +SELECT * +FROM sys.sql_logins +WHERE [name] = 'sa' OR [principal_id] = 1; +GO -If the login account name "SA" or "sa" appears in the query output, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-016400Execution of startup stored procedures must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. +If the login account name "SA" or "sa" appears in the query output, this is a finding.SRG-APP-000342-DB-000302<GroupDescription></GroupDescription>SQL6-D0-016400Execution of startup stored procedures must be restricted to necessary cases only.<VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. -When 'Scan for startup procs' is enabled, SQL Server scans for and runs all automatically run stored procedures defined on the server. The execution of start-up stored procedures will be done under a high privileged context, therefore it is a commonly used post-exploitation vector.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79321SV-94027CCI-002233To disable start up stored procedure(s), run the following in Master for each undocumented procedure: +When 'Scan for startup procs' is enabled, SQL Server scans for and runs all automatically run stored procedures defined on the server. The execution of start-up stored procedures will be done under a high privileged context, therefore it is a commonly used post-exploitation vector.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94027V-79321CCI-002233To disable start up stored procedure(s), run the following in Master for each undocumented procedure: sp_procoption @procname = '<procedure name>', @OptionName = 'Startup', @optionValue = 'Off'Review the system documentation to obtain a listing of documented stored procedures used by SQL Server during start up. Execute the following query: @@ -3421,9 +3419,9 @@ Select [name] as StoredProc From sys.procedures Where OBJECTPROPERTY(OBJECT_ID, 'ExecIsStartup') = 1 -If any stored procedures are returned that are not documented, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016500SQL Server Mirroring endpoint must utilize AES encryption.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. +If any stored procedures are returned that are not documented, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016500SQL Server Mirroring endpoint must utilize AES encryption.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. SQL Mirroring endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94029V-79323CCI-000366Run the following to enable encryption on the mirroring endpoint: @@ -3437,9 +3435,9 @@ SELECT name, type_desc, encryption_algorithm_desc FROM sys.database_mirroring_endpoints WHERE encryption_algorithm != 2 -If any records are returned, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016600SQL Server Service Broker endpoint must utilize AES encryption.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. +If any records are returned, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-016600SQL Server Service Broker endpoint must utilize AES encryption.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. SQL Server Service Broker endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94031V-79325CCI-000366Run the following to enable encryption on the Service Broker endpoint: @@ -3453,9 +3451,9 @@ SELECT name, type_desc, encryption_algorithm_desc FROM sys.service_broker_endpoints WHERE encryption_algorithm != 2 -If any records are returned, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016700SQL Server execute permissions to access the registry must be revoked, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If any records are returned, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016700SQL Server execute permissions to access the registry must be revoked, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3492,22 +3490,22 @@ WHERE major_id IN ( AND dp.[type] = 'EX' ORDER BY dpr.NAME; -If any records are returned, review the system documentation to determine whether the accessing of the registry via extended stored procedures are required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016800Filestream must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If any records are returned, review the system documentation to determine whether the accessing of the registry via extended stored procedures are required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-016800Filestream must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. -The most significant potential for attacking an instance is through the use of features that expose an external interface or ad hoc execution capability. FILESTREAM integrates the SQL Server Database Engine with an NTFS file system by storing varbinary(max) binary large object (BLOB) data as files on the file system. Transact-SQL statements can insert, update, query, search, and back up FILESTREAM data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79329SV-94035CCI-000381Disable the use of Filestream. +The most significant potential for attacking an instance is through the use of features that expose an external interface or ad hoc execution capability. FILESTREAM integrates the SQL Server Database Engine with an NTFS file system by storing varbinary(max) binary large object (BLOB) data as files on the file system. Transact-SQL statements can insert, update, query, search, and back up FILESTREAM data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94035V-79329CCI-000381Disable the use of Filestream. 1. Delete all FILESTREAM columns from all tables. ALTER TABLE <name> DROP COLUMN <column name> 2. Disassociate tables from the FILESTREAM filegroups. ALTER TABLE <name> SET (FILESTREAM_ON = 'NULL' 3. Remove all FILESTREAM data containers. ALTER DATABASE <name> REMOVE FILE <file name> 4. Remove all FILESTREAM filegroups. ALTER DATABASE <name> REMOVE FILEGROUP <file name>. 5. Disable FILESTREAM. -EXEC sp_configure filestream_access_level, 0 - RECONFIGURE -6. Restart the SQL ServiceReview the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. +EXEC sp_configure filestream_access_level, 0 + RECONFIGURE +6. Restart the SQL ServiceReview the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. If FileStream is not documented as being authorized, execute the following query. EXEC sp_configure 'filestream access level' @@ -3518,17 +3516,17 @@ If "run_value" is greater than "0", this is a finding. This rule checks that Filestream SQL specific option is disabled. -SELECT CASE - WHEN EXISTS (SELECT * - FROM sys.configurations - WHERE Name = 'filestream access level' - AND Cast(value AS INT) = 0) THEN 'No' +SELECT CASE + WHEN EXISTS (SELECT * + FROM sys.configurations + WHERE Name = 'filestream access level' + AND Cast(value AS INT) = 0) THEN 'No' ELSE 'Yes' END AS TSQLFileStreamAccess; -If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017000Ole Automation Procedures feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017000Ole Automation Procedures feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3538,45 +3536,45 @@ SQL Server is capable of providing a wide range of features and services. Some o The Ole Automation Procedures option controls whether OLE Automation objects can be instantiated within Transact-SQL batches. These are extended stored procedures that allow SQL Server users to execute functions external to SQL Server in the security context of SQL Server. -The Ole Automation Procedures extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79333SV-94039CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Ole Automation Procedures" option, from the query prompt:  +The Ole Automation Procedures extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94039V-79333CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Ole Automation Procedures" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'Ole Automation Procedures', 0; -GO -RECONFIGURE; -GOTo determine if "Ole Automation Procedures" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'Ole Automation Procedures', 0; +GO +RECONFIGURE; +GOTo determine if "Ole Automation Procedures" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'Ole Automation Procedures'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'Ole Automation Procedures'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017100SQL Server User Options feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017100SQL Server User Options feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. -The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79335SV-94041CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "User Options" option, from the query prompt:  +The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94041V-79335CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "User Options" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'user options', 0; -GO -RECONFIGURE; +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'user options', 0; +GO +RECONFIGURE; GOTo determine if "User Options" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'user options'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'user options'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017200Remote Access feature must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017200Remote Access feature must be disabled, unless specifically required and approved.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3584,26 +3582,26 @@ SQL Server may spawn additional external processes to execute procedures that ar SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. -The Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server.  'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79337SV-94043CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Access" option, from the query prompt:  +The Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server.  'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94043V-79337CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Access" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'remote access', 0; -GO -RECONFIGURE; -GOTo determine if "Remote Access" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'remote access', 0; +GO +RECONFIGURE; +GOTo determine if "Remote Access" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'remote access'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'remote access'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017400Hadoop Connectivity feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017400Hadoop Connectivity feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3611,26 +3609,26 @@ SQL Server may spawn additional external processes to execute procedures that ar SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. -The Hadoop Connectivity feature allows multiple types of external data sources to be created and used across all sessions on the server.  An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79341SV-94047CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Hadoop Connectivity" option, from the query prompt:  +The Hadoop Connectivity feature allows multiple types of external data sources to be created and used across all sessions on the server.  An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94047V-79341CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Hadoop Connectivity" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'hadoop connectivity', 0; -GO -RECONFIGURE; -GOTo determine if "Hadoop Connectivity" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'hadoop connectivity', 0; +GO +RECONFIGURE; +GOTo determine if "Hadoop Connectivity" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'hadoop connectivity'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'hadoop connectivity'; If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017500Allow Polybase Export feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017500Allow Polybase Export feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3640,24 +3638,24 @@ SQL Server is capable of providing a wide range of features and services. Some o The Allow Polybase Export feature allows an export of data to an external data source such as Hadoop File System or Azure Data Lake. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94049V-79343CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Allow Polybase Export" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'allow polybase export', 0; -GO -RECONFIGURE; -GOTo determine if "Allow Polybase Export" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'allow polybase export', 0; +GO +RECONFIGURE; +GOTo determine if "Allow Polybase Export" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'allow polybase export'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'allow polybase export'; If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017600Remote Data Archive feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL6-D0-017600Remote Data Archive feature must be disabled, unless specifically required and approved. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -3667,99 +3665,99 @@ SQL Server is capable of providing a wide range of features and services. Some o The Remote Data Archive feature allows an export of local SQL Server data to an Azure SQL Database. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94051V-79345CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Remote Data Archive" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'remote data archive', 0; -GO -RECONFIGURE; -GOTo determine if "Remote Data Archive" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'remote data archive', 0; +GO +RECONFIGURE; +GOTo determine if "Remote Data Archive" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'remote data archive'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'remote data archive'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017700SQL Server External Scripts Enabled feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017700SQL Server External Scripts Enabled feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. The External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94053V-79347CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "External Scripts Enabled" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'external scripts enabled', 0; -GO -RECONFIGURE; -GOTo determine if "External Scripts Enabled" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'external scripts enabled', 0; +GO +RECONFIGURE; +GOTo determine if "External Scripts Enabled" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'external scripts enabled'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'external scripts enabled'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-017800The SQL Server Browser service must be disabled unless specifically required and approved.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. +If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-017800The SQL Server Browser service must be disabled unless specifically required and approved.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. -This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. +This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. -This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94055V-79349CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. +This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94055V-79349CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. -Where SQL Server Browser is judged unnecessary, the Service can be disabled. +Where SQL Server Browser is judged unnecessary, the Service can be disabled. -To disable, in the Services tool, double-click "SQL Server Browser". Set "Startup Type" to "Disabled". If "Service Status" is "Running", click on "Stop". Click on "OK".If the need for the SQL Server Browser service is documented and authorized, this is not a finding. +To disable, in the Services tool, double-click "SQL Server Browser". Set "Startup Type" to "Disabled". If "Service Status" is "Running", click on "Stop". Click on "OK".If the need for the SQL Server Browser service is documented and authorized, this is not a finding. -Open the Services tool. +Open the Services tool. -Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services"; or at a command prompt, type "services.msc" and press the "Enter" key. +Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services"; or at a command prompt, type "services.msc" and press the "Enter" key. -Scroll to "SQL Server Browser". +Scroll to "SQL Server Browser". -If its Startup Type is not shown as "Disabled", this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017900SQL Server Replication Xps feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. +If its Startup Type is not shown as "Disabled", this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL6-D0-017900SQL Server Replication Xps feature must be disabled, unless specifically required and approved.<VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. Enabling the replication XPs opens a significant attack surface area that can be used by an attacker to gather information about the system and potentially abuse the privileges of SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94057V-79351CCI-000381Disable use of or remove any external application executable object definitions that are not authorized. To disable the use of "Replication Xps" option, from the query prompt:  -sp_configure 'show advanced options', 1; -GO -RECONFIGURE; -GO -sp_configure 'replication xps', 0; -GO -RECONFIGURE; -GOTo determine if the "Replication Xps" option is enabled, execute the following query: +sp_configure 'show advanced options', 1; +GO +RECONFIGURE; +GO +sp_configure 'replication xps', 0; +GO +RECONFIGURE; +GOTo determine if the "Replication Xps" option is enabled, execute the following query: -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'replication xps'; +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'replication xps'; -If the value of "config_value" is "0", this is not a finding. +If the value of "config_value" is "0", this is not a finding. -If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-018000If the SQL Server Browser Service is specifically required and approved, SQL instances must be hidden.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding.SRG-APP-000516-DB-000363<GroupDescription></GroupDescription>SQL6-D0-018000If the SQL Server Browser Service is specifically required and approved, SQL instances must be hidden.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. -This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. +This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. -This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances. In order to prevent this, the SQL instance(s) can be hidden.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79353SV-94059CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. +This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances. In order to prevent this, the SQL instance(s) can be hidden.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94059V-79353CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate authorization. -To hide the SQL instance, in SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, select "Properties", on the "Flags" tab, select "Yes" in the "HideInstance" box, then click "OK".  The change takes effect immediately for new connections.If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances that do not require use of the SQL Browser Service are hidden with the following query: +To hide the SQL instance, in SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, select "Properties", on the "Flags" tab, select "Yes" in the "HideInstance" box, then click "OK".  The change takes effect immediately for new connections.If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances that do not require use of the SQL Browser Service are hidden with the following query: -DECLARE @HiddenInstance INT -EXEC master.dbo.Xp_instance_regread - N'HKEY_LOCAL_MACHINE', - N'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', - N'HideInstance', - @HiddenInstance output +DECLARE @HiddenInstance INT +EXEC master.dbo.Xp_instance_regread + N'HKEY_LOCAL_MACHINE', + N'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', + N'HideInstance', + @HiddenInstance output -SELECT CASE - WHEN @HiddenInstance = 0 - AND Serverproperty('IsClustered') = 0 THEN 'No' - ELSE 'Yes' +SELECT CASE + WHEN @HiddenInstance = 0 + AND Serverproperty('IsClustered') = 0 THEN 'No' + ELSE 'Yes' END AS [Hidden] If the value of "Hidden" is "Yes", this is not a finding. -If the value of "Hidden" is "No" and the startup type of the "SQL Server Browser" service is not "Disabled", this is a finding.SRG-APP-000178-DB-000083<GroupDescription></GroupDescription>SQL6-D0-018100When using command-line tools such as SQLCMD in a mixed-mode authentication environment, users must use a logon method that does not expose the password.<VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. +If the value of "Hidden" is "No" and the startup type of the "SQL Server Browser" service is not "Disabled", this is a finding.SRG-APP-000178-DB-000083<GroupDescription></GroupDescription>SQL6-D0-018100When using command-line tools such as SQLCMD in a mixed-mode authentication environment, users must use a logon method that does not expose the password.<VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided information when typed into the system is a method used in addressing this risk. @@ -3767,7 +3765,7 @@ For example, displaying asterisks when a user types in a password or PIN, is an This requirement is applicable when mixed-mode authentication is enabled. When this is the case, password-authenticated accounts can be created in and authenticated by SQL Server. Other STIG requirements prohibit the use of mixed-mode authentication except when justified and approved. This deals with the exceptions. -SQLCMD and other command-line tools are part of any SQL Server installation. These tools can accept a plain-text password, but do offer alternative techniques. Since the typical user of these tools is a database administrator, the consequences of password compromise are particularly serious. Therefore, the use of plain-text passwords must be prohibited, as a matter of practice and procedure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79355SV-94061CCI-000206Where possible, change the login mode to Windows-only: +SQLCMD and other command-line tools are part of any SQL Server installation. These tools can accept a plain-text password, but do offer alternative techniques. Since the typical user of these tools is a database administrator, the consequences of password compromise are particularly serious. Therefore, the use of plain-text passwords must be prohibited, as a matter of practice and procedure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94061V-79355CCI-000206Where possible, change the login mode to Windows-only: USE [master] GO EXEC xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'LoginMode', REG_DWORD, 1; @@ -3776,18 +3774,18 @@ GO If mixed-mode authentication is necessary, then for SQLCMD, which cannot be configured not to accept a plain-text password when mixed-mode authentication is enabled, and any other essential tool with the same limitation: 1) Document the need for it, who uses it, and any relevant mitigations, and obtain AO approval. 2) Train all users of the tool in the importance of not using the plain-text password option and in how to keep the password hidden.Run this query to determine whether SQL Server authentication is enabled: -EXEC master.sys.xp_loginconfig 'login mode'; +EXEC master.sys.xp_loginconfig 'login mode'; If the config_value returned is "Windows NT Authentication", this is not a finding. For SQLCMD, which cannot be configured not to accept a plain-text password, and any other essential tool with the same limitation, verify that the system documentation explains the need for the tool, who uses it, and any relevant mitigations; and that AO approval has been obtained; if not, this is a finding. -Request evidence that all users of the tool are trained in the importance of not using the plain-text password option and in how to keep the password hidden; and that they adhere to this practice; if not, this is a finding.SRG-APP-000178-DB-000083<GroupDescription></GroupDescription>SQL6-D0-018200Applications must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.<VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. +Request evidence that all users of the tool are trained in the importance of not using the plain-text password option and in how to keep the password hidden; and that they adhere to this practice; if not, this is a finding.SRG-APP-000178-DB-000083<GroupDescription></GroupDescription>SQL6-D0-018200Applications must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.<VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided information when typed into the system is a method used in addressing this risk. For example, displaying asterisks when a user types in a password or PIN, is an example of obscuring feedback of authentication information. -Database applications may allow for entry of the account name and password as a visible parameter of the application execution command. This practice must be prohibited and disabled to prevent shoulder surfing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993V-79357SV-94063CCI-000206Configure or modify applications to prohibit display of passwords in clear text.Determine whether any applications that access the database allow for entry of the account name and password, or PIN. +Database applications may allow for entry of the account name and password as a visible parameter of the application execution command. This practice must be prohibited and disabled to prevent shoulder surfing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target MS SQL Server 2016 InstanceDISADPMS TargetMS SQL Server 2016 Instance3993SV-94063V-79357CCI-000206Configure or modify applications to prohibit display of passwords in clear text.Determine whether any applications that access the database allow for entry of the account name and password, or PIN. If any do, determine whether these applications obfuscate authentication data; if they do not, this is a finding. diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R2_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_STIG_V2R2_Manual-xccdf.log similarity index 84% rename from source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R2_Manual-xccdf.log rename to source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_STIG_V2R2_Manual-xccdf.log index e2943dd51..67cdc6cc0 100644 --- a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_V1R2_Manual-xccdf.log +++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_STIG_V2R2_Manual-xccdf.log @@ -1,4 +1,5 @@ -V-100115::This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files::If an account associated with roles other than auditors -V-100177::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'; ValueData = 0; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'} -V-100163::CREATOR OWNER: Full Control, Subfolders and files only::CREATOR OWNER: Full Control - Subfolders and files only -V-100145::Under Time-out (in minutes), verify “20 minutes or less” is selected.::Verify the "Time-out (in minutes)" is set to "20 minutes or less". +V-218790::This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files::If an account associated with roles other than auditors +V-218821::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'; ValueData = 0; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'} +V-218814::CREATOR OWNER: Full Control, Subfolders and files only::CREATOR OWNER: Full Control - Subfolders and files only +V-218805::Under Time-out (in minutes), verify “20 minutes or less” is selected.::Verify the "Time-out (in minutes)" is set to "20 minutes or less". +V-241788::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\CurrentControlSet\Services\HTTP\Parameters'; ValueData = 1; ValueName = 'DisableServerHeader'; ValueType = 'DWORD'} diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_STIG_V2R2_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_STIG_V2R2_Manual-xccdf.xml new file mode 100644 index 000000000..4f32fbd77 --- /dev/null +++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Server_STIG_V2R2_Manual-xccdf.xml @@ -0,0 +1,946 @@ +acceptedMicrosoft IIS 10.0 Server Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 23 Apr 20213.2.2.360791.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-APP-000015-WSR-000014<GroupDescription></GroupDescription>IIST-SV-000100The IIS 10.0 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.<VulnDiscussion>Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used. - -An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001453Ensure the web server administration is only performed over a secure path.If web administration is performed at the console, this check is NA. - -If web administration is performed remotely the following checks will apply: - -If administration of the server is performed remotely, it will only be performed securely by system administrators. - -If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO. - -Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable Network STIGs. - -Remote administration of any kind will be restricted to documented and authorized personnel. - -All users performing remote administration must be authenticated. - -All remote sessions will be encrypted and utilize FIPS 140-2-approved protocols. - -FIPS 140-2-approved TLS versions include TLS V1.1 or greater. - -Review with site management how remote administration is configured on the website, if applicable. - -If remote management meets the criteria listed above, this is not a finding. - -If remote management is utilized and does not meet the criteria listed above, this is a finding.SRG-APP-000092-WSR-000055<GroupDescription></GroupDescription>IIST-SV-000102The enhanced logging for the IIS 10.0 web server must be enabled and capture all user and web server events.<VulnDiscussion>Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information, web administrators can leverage them in the event of a disaster, malicious attack, or other site specific needs. - -Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety. - -Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked. - -Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000097-WSR-000059</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000130CCI-000131CCI-000132CCI-000133CCI-001462CCI-001464Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Click the "Logging" icon. - -Under Format select "W3C". - -Select the following fields: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer. - -Under the "Actions" pane, click "Apply".Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Click the "Logging" icon. - -Under Format select "W3C". - -Click "Select Fields", verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer. - -If not, this is a finding.SRG-APP-000092-WSR-000055<GroupDescription></GroupDescription>IIST-SV-000103Both the log file and Event Tracing for Windows (ETW) for the IIS 10.0 web server must be enabled.<VulnDiscussion>Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process. - -In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time. - -Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000139CCI-001464CCI-001851Open the IIS 10.0 Manager. - -Click the IIS 10.0 server name. - -Click the "Logging" icon. - -Under Log Event Destination, select the "Both log file and ETW event" radio button. - -Under the "Actions" pane, click "Apply".Open the IIS 10.0 Manager. - -Click the IIS 10.0 server name. - -Click the "Logging" icon. - -Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected. - -If the "Both log file and ETW event" radio button is not selected, this is a finding.SRG-APP-000098-WSR-000060<GroupDescription></GroupDescription>IIST-SV-000109An IIS 10.0 web server behind a load balancer or proxy server must produce log records containing the source client IP and destination information.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise. - -A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000133Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 10.0 web server transparently.Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy. - -If the IIS 10.0 web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. - -Follow this procedure for web server and each website: - -Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Click the "Logging" icon. - -Click on "View log files" under the "Actions" pane. - -When the log file is displayed, review source IP information in log entries and verify the entries do not reflect the IP address of the proxy server. - -If the website is not behind a load balancer or proxy server, this is Not Applicable. - -If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding. - -If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.SRG-APP-000099-WSR-000061<GroupDescription></GroupDescription>IIST-SV-000110The IIS 10.0 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 web server events.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise. - -Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000134Access the IIS 10.0 web server IIS Manager. -Click the IIS 10.0 web server name. -Under "IIS", double-click the "Logging" icon. -Verify the "Format:" under "Log File" is configured to "W3C". -Select the "Fields" button. -Under "Custom Fields", click the "Add Field..." button. -For each field being added, give a name unique to what the field is capturing. -Click on the "Source Type" drop-down list and select "Request Header". -Click on the "Source" drop-down list and select "Connection". -Click "OK" to add. - -Click on the "Source Type" drop-down list and select "Request Header". -Click on the "Source" drop-down list and select "Warning". -Click "OK" to add. -Click "Apply" under the "Actions" pane.Access the IIS 10.0 web server IIS Manager. -Click the IIS 10.0 web server name. -Under "IIS", double-click the "Logging" icon. -Verify the "Format:" under "Log File" is configured to "W3C". -Select the "Fields" button. -Under "Custom Fields", verify the following fields have been configured: -Request Header >> Connection -Request Header >> Warning -If any of the above fields are not selected, this is a finding.SRG-APP-000100-WSR-000064<GroupDescription></GroupDescription>IIST-SV-000111The IIS 10.0 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools. - -Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001487Access the IIS 10.0 web server IIS Manager. -Click the IIS 10.0 web server name. -Under "IIS", double-click the "Logging" icon. -Verify the "Format:" under "Log File" is configured to "W3C". -Select the "Fields" button. -Under "Standard Fields", select "User Agent", "User Name", and "Referrer". -Under "Custom Fields", select the following fields: -Click on the "Source Type" drop-down list and select "Request Header". -Click on the "Source" drop-down list and select "Authorization". -Click "OK" to add. - -Click on the "Source" drop-down list and select "Content-Type". -Click on the "Source Type" drop-down list and select "Response Header". -Click "OK" to add. -Click "OK". -Click "Apply" under the "Actions" pane.Access the IIS 10.0 web server IIS Manager. -Click the IIS 10.0 web server name. -Under "IIS", double-click the "Logging" icon. -Verify the "Format:" under "Log File" is configured to "W3C". -Select the "Fields" button. -Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected. -Under "Custom Fields", verify the following field has been configured: -Request Header >> Authorization -Response Header >> Content-Type -If any of the above fields are not selected, this is a finding.SRG-APP-000120-WSR-000070<GroupDescription></GroupDescription>IIST-SV-000115The log information from the IIS 10.0 web server must be protected from unauthorized modification or deletion.<VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the System Administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity. - -Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000164Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Click the "Logging" icon. - -Click "Browse" and navigate to the directory where the log files are stored. - -Right-click the log file name to review and click "Properties". - -Click the "Security" tab. - -Set the log file permissions for the appropriate group(s). - -Click "OK". - -Select "Apply" in the "Actions" pane.This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. -Open the IIS 10.0 Manager. -Click the IIS 10.0 web server name. -Click the "Logging" icon. -Click "Browse" and navigate to the directory where the log files are stored. -Right-click the log file name to review. -Click "Properties". -Click the "Security" tab. -Verify log file access is restricted as follows. Otherwise, this is a finding. -SYSTEM - Full Control -Administrators - Full ControlSRG-APP-000125-WSR-000071<GroupDescription></GroupDescription>IIST-SV-000116The log data and records from the IIS 10.0 web server must be backed up onto a different system or media.<VulnDiscussion>Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system, or onto separate media than the system on which the web server is running, helps to ensure the log records will be retained in the event of a catastrophic system failure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001348Configure system backups to include the directory paths of all IIS 10.0 web server and website log files.The IIS 10.0 web server and website log files should be backed up by the system backup. - -To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files. - -Open the IIS 10.0 Manager. - -Click the IIS 10.0 server name. - -Click the "Logging" icon. - -Under "Log File" >> "Directory" obtain the path of the log file. - -Once all locations are known, consult with the System Administrator to review the server's backup procedure and policy. - -Verify the paths of all log files are part of the system backup. -Verify log files are backed up to an unrelated system or onto separate media on which the system the web server is running. - -If the paths of all log files are not part of the system backup and/or not backed up to a separate media, this is a finding.SRG-APP-000141-WSR-000015<GroupDescription></GroupDescription>IIST-SV-000117The IIS 10.0 web server must not perform user management for hosted applications.<VulnDiscussion>User management and authentication can be an essential part of any application hosted by the web server. Along with authenticating users, the user management function must perform several other tasks enterprise-wide, such as password complexity, locking users after a configurable number of failed logons, and management of temporary and emergency accounts. - -The web server contains a minimal user management function, but the web server user management function does not offer enterprise-wide user management, and user management is not the primary function of the web server. User management for the hosted applications should be done through a facility built for enterprise-wide user management, such as LDAP and Active Directory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Reconfigure any hosted applications on the IIS 10.0 web server to perform user management outside the IIS 10.0 web server. - -Document how the hosted application user management is accomplished.Interview the System Administrator about the role of the IIS 10.0 web server. - -If the IIS 10.0 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server. - -If the IIS 10.0 web server is not hosting an application, this is Not Applicable. - -If the IIS web server is performing user management for hosted applications, this is a finding. - -If the IIS 10.0 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 10.0 web server, this is a finding.SRG-APP-000141-WSR-000075<GroupDescription></GroupDescription>IIST-SV-000118The IIS 10.0 web server must only contain functions necessary for operation.<VulnDiscussion>A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DoD system. - -The web server must provide the capability to disable, uninstall, or deactivate functionality and services deemed non-essential to the web server mission or that adversely impact server performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Remove all unapproved programs and roles from the production IIS 10.0 web server.Click “Start”. - -Open Control Panel. - -Click “Programs”. - -Click “Programs and Features”. - -Review the installed programs. If any programs are installed other than those required for the IIS 10.0 web services, this is a finding. - -Note: If additional software is needed, supporting documentation must be signed by the ISSO.SRG-APP-000141-WSR-000076<GroupDescription></GroupDescription>IIST-SV-000119The IIS 10.0 web server must not be both a website server and a proxy server.<VulnDiscussion>A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that also proxy requests into an otherwise protected network is a common attack, making the attack anonymous.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Open the IIS 10.0 Manager. - -Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server. - -Under the IIS installed features, "Application Request Routing Cache" is present, double-click the icon to open the feature. - -From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...". - -In the "Application Request Routing" settings window, remove the check from the "Enable proxy" check box. - -Click "Apply" in the "Actions" pane.Open the IIS 10.0 Manager. - -Under the "Connections" pane on the left side of the management console, select the IIS 10.0 web server. - -If, under the IIS installed features, "Application Request Routing Cache" is not present, this is not a finding. - -If, under the IIS installed features, "Application Request Routing Cache" is present, double-click the icon to open the feature. - -From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...". - -In the "Application Request Routing" settings window, verify whether "Enable proxy" is selected. - -If “Enable proxy" is selected under the "Application Request Routing" settings, this is a finding.SRG-APP-000141-WSR-000077<GroupDescription></GroupDescription>IIST-SV-000120All IIS 10.0 web server sample code, example applications, and tutorials must be removed from a production IIS 10.0 server.<VulnDiscussion>Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Remove any executable sample code, example applications, or tutorials which are not explicitly used by a production website.Navigate to the following folders: - -inetpub\ -Program Files\Common Files\System\msadc -Program Files (x86)\Common Files\System\msadc - -If the folder or sub-folders contain any executable sample code, example applications, or tutorials which are not explicitly used by a production website, this is a finding.SRG-APP-000141-WSR-000078<GroupDescription></GroupDescription>IIST-SV-000121The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 10.0 server.<VulnDiscussion>Accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services created when the feature is not installed, become an exploitable threat to a web server. - -These accounts become inactive, are not monitored through regular use, and passwords for the accounts are not created or updated. An attacker, through very little effort, can use these accounts to gain access to the web server and begin investigating ways to elevate the account privileges. - -The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Access the IIS 10.0 web server. - -Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”. - -In the left pane, expand "Local Users and Groups" and click "Users". - -Delete any local accounts which were created by features which have been uninstalled or are not used.Access the IIS 10.0 web server. - -Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”. - -In the left pane, expand "Local Users and Groups" and click "Users". - -Review the local users listed in the middle pane. - -If any local accounts are present and were created by features which have been uninstalled or are not used, this is a finding.SRG-APP-000141-WSR-000080<GroupDescription></GroupDescription>IIST-SV-000123The IIS 10.0 web server must be reviewed on a regular basis to remove any Operating System features, utility programs, plug-ins, and modules not necessary for operation.<VulnDiscussion>Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is a danger at the application layer of the OSI model. Office suites, development tools, and graphic editors are examples of such troublesome programs. - -Individual productivity tools have no legitimate place or use on an enterprise production web server and are prone to security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services, and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Remove all utility programs, Operating System features, or modules installed that are not necessary for web server operation.Consult with the System Administrator and review all of the IIS 10.0 and Operating System features installed. - -Determine if any features installed are no longer necessary for operation. - -If any utility programs, features, or modules are installed which are not necessary for operation, this is a finding. - -If any unnecessary Operating System features are installed, this is a finding.SRG-APP-000141-WSR-000081<GroupDescription></GroupDescription>IIST-SV-000124The IIS 10.0 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.<VulnDiscussion>Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. - -A MIME tells the web server the type of program, various file types, and extensions and what external utilities or programs are needed to execute the file type. - -A shell is a program that serves as the basic interface between the user and the operating system to ensure hosted application users do not have access to these programs. Shell programs may execute shell escapes and can perform unauthorized activities that could damage the security posture of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under IIS, double-click the "MIME Types" icon. - -From the "Group by:" drop-down list, select "Content Type". - -From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions: - -.exe -.dll -.com -.bat -.csh - -Under the "Actions" pane, click "Apply".Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under IIS, double-click the "MIME Types" icon. - -From the "Group by:" drop-down list, select "Content Type". - -From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: - -.exe -.dll -.com -.bat -.csh - -If any OS shell MIME types are configured, this is a finding.SRG-APP-000141-WSR-000085<GroupDescription></GroupDescription>IIST-SV-000125The IIS 10.0 web server must have Web Distributed Authoring and Versioning (WebDAV) disabled.<VulnDiscussion>A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol which, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. - -WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Access Server Manager on the IIS 10.0 web server. - -Click the IIS 10.0 web server name. - -Click on "Manage". - -Select "Add Roles and Features". - -Click "Next" in the "Before you begin" dialog box. - -Select "Role-based or feature-based installation" on the "Installation Type" dialog box and click "Next". - -Select the IIS 10.0 web server in the "Server Selection" dialog box. - -From the "Windows Features" dialog box, navigate to "World Wide Web Services" >> "Common HTTP Features". - -De-select "WebDAV Publishing", and click "Next" to complete removing the WebDAV Publishing feature from the IIS 10.0 web server.Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Review the features listed under the “IIS" section. - -If the "WebDAV Authoring Rules" icon exists, this is a finding.SRG-APP-000175-WSR-000095<GroupDescription></GroupDescription>IIST-SV-000129The IIS 10.0 web server must perform RFC 5280-compliant certification path validation.<VulnDiscussion>This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid, and therefore; the entire purpose of using a certificate is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000185Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Server Certificate" icon. - -Import a valid DoD certificate and remove any non-DoD certificates.Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Server Certificate" icon. - -Double-click each certificate and verify the certificate path is to a DoD root CA. - -If the “Issued By” field of the PKI certificate being used by the IIS 10.0 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.SRG-APP-000206-WSR-000128<GroupDescription></GroupDescription>IIST-SV-000130Java software installed on a production IIS 10.0 web server must be limited to .class files and the Java Virtual Machine.<VulnDiscussion>Mobile code in hosted applications allows the developer to add functionality and displays to hosted applications that are fluid, as opposed to a static web page. The data presentation becomes more appealing to the user, is easier to analyze, and is less complicated to navigate through the hosted application and data. - -Some mobile code technologies in use in today's applications are: Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. The DoD has created policies that define the usage of mobile code on DoD systems. The usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations. - -Source code for a Java program is often stored in files with either .java or .jpp file extensions. From the .java and .jpp files the Java compiler produces a binary file with an extension of .class. The .java or .jpp file could therefore reveal sensitive information regarding an application's logic and permissions to resources on the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001166Remove all files from the web server with both .java and .jpp extensions.Search the system for files with either .java or .jpp extensions. - -If files with .java or .jpp extensions are found, this is a finding.SRG-APP-000211-WSR-000030<GroupDescription></GroupDescription>IIST-SV-000131IIS 10.0 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.<VulnDiscussion>As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001082Ensure non-administrators are not allowed access to the directory tree, the shell, or other operating system functions and utilities. - -All non-administrator access to shell scripts and operating system functions must be mission essential and documented.Obtain a list of the user accounts with access to the system, including all local and domain accounts. - -Review the privileges to the web server for each account. - -Verify with the system administrator or the ISSO that all privileged accounts are mission essential and documented. - -Verify with the system administrator or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented. - -If undocumented privileged accounts are found, this is a finding. - -If undocumented non-administrator access to shell scripts and operating system functions are found, this is a finding. - -If this IIS 10 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.SRG-APP-000211-WSR-000129<GroupDescription></GroupDescription>IIST-SV-000132The IIS 10.0 web server must separate the hosted applications from hosted web server management functionality.<VulnDiscussion>The separation of user functionality from web server management can be accomplished by moving management functions to a separate IP address or port. To further separate the management functions, separate authentication methods and certificates should be used. - -By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001082Develop a method to manage the hosted applications, either by moving its management functions off of the IIS 10.0 web server or by accessing the application's management via a uniquely assigned IP address.Review the IIS 10.0 web server configuration with the System Administrator. - -Determine if the IIS 10.0 web server hosts any applications. - -If the IIS 10.0 web server does not host any applications, this is Not Applicable. - -If the IIS 10.0 web server hosts applications, review the application's management functionality and authentication methods with the System Administrator to determine if the management of the application is accomplished with the same functions and authentication methods as the web server management. - -If the IIS 10.0 web server management and the application's management functionality is not separated, this is a finding.SRG-APP-000223-WSR-000011<GroupDescription></GroupDescription>IIST-SV-000134The IIS 10.0 web server must use cookies to track session state.<VulnDiscussion>Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. - -Using URI will embed the session ID as a query string in the Uniform Resource Identifier (URI) request and then the URI is redirected to the originally requested URL. The changed URI request is used for the duration of the session, so no cookie is necessary. - -By requiring expired session IDs to be regenerated while using URI, potential attackers have less time to capture a cookie and gain access to the Web server content. - -Satisfies: SRG-APP-000223-WSR-000011, SRG-APP-000220-WSR-000201</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001664Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under "ASP.Net", double-click the "Session State" icon. - -Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list. - -Click "Apply" in the "Actions" pane.Open the IIS 10.0 Manager. -Click the IIS 10.0 web server name. -Under "ASP.Net", double-click the "Session State" icon. -Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list. -If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding. - -Alternative method: - -Click the site name. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". -Verify the "cookieless" is set to "UseCookies". -If the "cookieless" is not set to "UseCookies", this is a finding. - -Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.SRG-APP-000223-WSR-000145<GroupDescription></GroupDescription>IIST-SV-000135The IIS 10.0 web server must accept only system-generated session identifiers.<VulnDiscussion>ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session. - -When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001664Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under the "ASP.NET" section, select "Session State". - -Under "Cookie Settings", select the "Use Cookies" mode from the "Mode:" drop-down list. - -Under “Time-out (in minutes), enter a value of “20 or less”.Open the IIS 10.0 Manager. -Click the IIS 10.0 web server name. -Under the "ASP.NET" section, select "Session State". -Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list. -Under Time-out (in minutes), verify “20 minutes or less” is selected. -If the "Use Cookies” mode is selected and Time-out (in minutes) is configured for “20 minutes or less”, this is not a finding. - -Alternative method: - -Click the site name. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". -Verify the "cookieless" is set to "UseCookies". -If the "cookieless" is not set to "UseCookies", this is a finding. - -Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.SRG-APP-000225-WSR-000074<GroupDescription></GroupDescription>IIST-SV-000136The IIS 10.0 web server must augment re-creation to a stable and known baseline.<VulnDiscussion>Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the possibility for security risks. The web server must offer, and not hinder, a method that allows for the quick and easy reinstallation of a verified and patched baseline to guarantee the production web server is up-to-date and has not been modified to add functionality or expose security risks. - -When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001190Prepare documentation for disaster recovery methods for the IIS 10.0 web server in the event of the necessity for rollback. - -Document and test the disaster recovery methods designed.Interview the System Administrator for the IIS 10.0 web server. - -Ask for documentation on the disaster recovery methods tested and planned for the IIS 10.0 web server in the event of the necessity for rollback. - -If documentation for a disaster recovery has not been established, this is a finding.SRG-APP-000231-WSR-000144<GroupDescription></GroupDescription>IIST-SV-000137The production IIS 10.0 web server must utilize SHA2 encryption for the Machine Key.<VulnDiscussion>The Machine Key element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, forms authentication, membership and roles, and anonymous identification. Ensuring a strong encryption method can mitigate the risk of data tampering in crucial functional areas such as forms authentication cookies, or view state.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001199Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Machine Key" icon in the web server Home Pane. - -Set the Validation method to "HMACSHA256" or stronger. -Set the Encryption method to "Auto". - -Click "Apply" in the "Actions" pane.Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Machine Key" icon in the website Home Pane. - -Verify "HMACSHA256" or stronger encryption is selected for the Validation method and "Auto" is selected for the Encryption method. - -If "HMACSHA256" or stronger encryption is not selected for the Validation method and/or "Auto" is not selected for the Encryption method, this is a finding. - -If .NET is not installed, this is Not Applicable.SRG-APP-000251-WSR-000157<GroupDescription></GroupDescription>IIST-SV-000138Directory Browsing on the IIS 10.0 web server must be disabled.<VulnDiscussion>Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled, the risk of inadvertently disclosing sensitive content is increased.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001310Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Directory Browsing" icon. - -Under the "Actions" pane click "Disabled". - -Under the "Actions" pane, click "Apply".Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Directory Browsing" icon. - -Under the “Actions” pane verify "Directory Browsing" is disabled. - -If “Directory Browsing” is not disabled, this is a finding.SRG-APP-000266-WSR-000142<GroupDescription></GroupDescription>IIST-SV-000139The IIS 10.0 web server Indexing must only index web content.<VulnDiscussion>The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001312Run MMC. - -Add the Indexing Service snap-in. - -Edit the indexed directories to only include web document directories.Access the IIS 10.0 Web Server. - -Access an administrator command prompt and type "regedit <enter>" to access the server's registry. - -Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\. - -If this key exists, then indexing is enabled. - -If the key does not exist, this check is Not Applicable. - -Review the Catalog keys to determine if directories other than web document directories are being indexed. - -If so, this is a finding.SRG-APP-000266-WSR-000159<GroupDescription></GroupDescription>IIST-SV-000140Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 web server, patches, loaded modules, and directory paths.<VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001312Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Error Pages" icon. - -Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages. - -Set Feature Setting to “Detailed errors for local requests and custom error pages for remote requests”.Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Error Pages" icon. - -Click any error message, and then click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages. - -If the feature setting is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.SRG-APP-000315-WSR-000003<GroupDescription></GroupDescription>IIST-SV-000141Remote access to the IIS 10.0 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.<VulnDiscussion>Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002314Ensure the web server administration is only performed over a secure path.If web administration is performed at the console, this check is NA. - -If web administration is performed remotely, the following checks will apply: - -If administration of the server is performed remotely, it will only be performed securely by system administrators. - -If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO. - -Remote administration must be in compliance with any requirements contained within the Windows Server STIGs and any applicable Network STIGs. - -Remote administration of any kind will be restricted to documented and authorized personnel. - -All users performing remote administration must be authenticated. - -All remote sessions will be encrypted and utilize FIPS 140-2-approved protocols. - -FIPS 140-2-approved TLS versions include TLS V1.2 or greater. - -Review with site management how remote administration is configured on the website, if applicable. - -If remote management meets the criteria listed above, this is not a finding. - -If remote management is utilized and does not meet the criteria listed above, this is a finding. -SRG-APP-000315-WSR-000004<GroupDescription></GroupDescription>IIST-SV-000142The IIS 10.0 web server must restrict inbound connections from non-secure zones.<VulnDiscussion>Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions. - -A web server can be accessed remotely and must be capable of restricting access from what the DoD defines as non-secure zones. Non-secure zones are defined as any IP, subnet, or region defined as a threat to the organization. The non-secure zones must be defined for public web servers logically located in a DMZ, as well as private web servers with perimeter protection devices. By restricting access from non-secure zones through internal web server access lists, the web server can stop or slow denial of service (DoS) attacks on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002314Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under "Management", double-click "Management Service". - -Stop the Web Management Service under the "Actions" pane. - -Configure only known, secure IP ranges as "Allow". - -Select "Apply" in "Actions" pane. - -Restart the Web Management Service under the "Actions" pane.Note: This requirement applies to the Web Management Service. If the Web Management Service is not installed, this is Not Applicable. - -Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under "Management", double-click "Management Service". - -If "Enable remote connections" is not selected, this is Not Applicable. - -If "Enable remote connections" is selected, review the entries under "IP Address Restrictions". - -Verify only known, secure IP ranges are configured as "Allow". - -If "IP Address Restrictions" are not configured or IP ranges configured to "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.SRG-APP-000316-WSR-000170<GroupDescription></GroupDescription>IIST-SV-000143The IIS 10.0 web server must provide the capability to immediately disconnect or disable remote access to the hosted applications.<VulnDiscussion>During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack. - -The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list. - -The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002322Prepare documented procedures for shutting down an IIS 10.0 website in the event of an attack. - -The procedure should, at a minimum, provide the following steps: - -Determine the respective website for the application at risk of an attack. - -Access the IIS 10.0 web server IIS Manager. - -Select the respective website. - -In the "Actions" pane, under "Manage Website", click "Stop". - -If necessary, stop all websites. - -If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager. - -In the "Actions" pane, under "Manage Server", click "Stop".Interview the System Administrator and Web Manager. - -Ask for documentation for the IIS 10.0 web server administration. - -Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps: - -Determine the respective website for the application at risk of an attack. - -Access the IIS 10.0 web server IIS Manager. - -Select the respective website. - -In the "Actions" pane, under "Manage Website", click "Stop". - -If necessary, stop all websites. - -If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS Manager. - -In the "Actions" pane, under "Manage Server", click "Stop". - -If the web server is not capable or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.SRG-APP-000340-WSR-000029<GroupDescription></GroupDescription>IIST-SV-000144IIS 10.0 web server system files must conform to minimum file permission requirements.<VulnDiscussion>This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002235Open Explorer and navigate to the inetpub directory. - -Right-click "inetpub" and select "Properties". - -Click the "Security" tab. - -Set the following permissions: - -SYSTEM: Full control -Administrators: Full control -TrustedInstaller: Full control -ALL APPLICATION PACKAGES (built-in security group): Read and execute -Users: Read and execute, list folder contents -CREATOR OWNER: special permissions to subkeysOpen Explorer and navigate to the inetpub directory. - -Right-click "inetpub" and select "Properties". - -Click the "Security" tab. - -Verify the permissions for the following users; if the permissions are less restrictive, this is a finding. - -System: Full control -Administrators: Full control -TrustedInstaller: Full control -ALL APPLICATION PACKAGES (built-in security group): Read and execute -ALL RESTRICTED APPLICATION PACKAGES (built-in security group): Read and execute -Users: Read and execute, list folder contents -CREATOR OWNER: Full Control, Subfolders and files onlySRG-APP-000357-WSR-000150<GroupDescription></GroupDescription>IIST-SV-000145The IIS 10.0 web server must use a logging mechanism configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 10.0 web server.<VulnDiscussion>To ensure the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity. - -The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001849Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under "IIS" double-click on the "Logging" icon. - -If necessary, in the "Logging" configuration box, re-designate a log path to a location able to house the logs. - -Under "Log File Rollover", de-select the "Do not create new log files" setting. - -Configure a schedule to rollover log files on a regular basis.Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under "IIS" double-click the "Logging" icon. - -In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written. - -Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging. - -Under "Log File Rollover", verify "Do not create new log files" is not selected. - -Verify a schedule is configured to rollover log files on a regular basis. - -Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device. - -If the designated logging path device is not of sufficient space to maintain all log files, and there is not a schedule to rollover files on a regular basis, this is a finding.SRG-APP-000380-WSR-000072<GroupDescription></GroupDescription>IIST-SV-000147Access to web administration tools must be restricted to the web manager and the web managers designees.<VulnDiscussion>A web server can be modified through parameter modification, patch installation, upgrades to the web server or modules, and security parameter changes. With each of these changes, there is the potential for an adverse effect such as a DoS, web server instability, or hosted application instability. - -To limit changes to the web server and limit exposure to any adverse effects from the changes, files such as the web server application files, libraries, and configuration files must have permissions and ownership set properly to only allow privileged users access. - -The key web service administrative and configuration tools must only be accessible by the web server staff. All users granted this authority will be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators. - -Satisfies: SRG-APP-000380-WSR-000072, SRG-APP-000435-WSR-000147, SRG-APP-000033-WSR-000169</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000213CCI-001813CCI-002385Restrict access to the web administration tool to only the web manager and the web manager’s designees.Right-click "InetMgr.exe", then click "Properties" from the "Context" menu. - -Select the "Security" tab. - -Review the groups and user names. - -The following accounts may have Full control privileges: - -TrustedInstaller -Web Managers -Web Manager designees -CREATOR OWNER: Full Control, Subfolders and files only - -The following accounts may have read and execute, or read permissions: - -Non Web Manager Administrators -ALL APPLICATION PACKAGES (built-in security group) -ALL RESTRICTED APPLICATION PACKAGES (built-in security group) -SYSTEM -Users - -Specific users may be granted read and execute and read permissions. - -Compare the local documentation authorizing specific users, against the users observed when reviewing the groups and users. - -If any other access is observed, this is a finding.SRG-APP-000383-WSR-000175<GroupDescription></GroupDescription>IIST-SV-000148The IIS 10.0 web server must not be running on a system providing any other role.<VulnDiscussion>Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system. - -The web server must provide the capability to disable or deactivate network-related services deemed non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001762Remove all unapproved programs and roles from the production web server.Review programs installed on the OS. - -Open Control Panel. - -Open Programs and Features. - -The following programs may be installed without any additional documentation: - -Administration Pack for IIS -IIS Search Engine Optimization Toolkit -Microsoft .NET Framework version 3.5 SP1 or greater -Microsoft Web Platform Installer version 3.x or greater -Virtual Machine Additions - -Review the installed programs, if any programs are installed other than those listed above, this is a finding. - -Note: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.SRG-APP-000383-WSR-000175<GroupDescription></GroupDescription>IIST-SV-000149The Internet Printing Protocol (IPP) must be disabled on the IIS 10.0 web server.<VulnDiscussion>The use of IPP on an IIS web server allows client access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-001762Click “Start”, click “Administrative Tools”, and then click “Server Manager”. - -Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”. - -If the Internet Printing option is checked, clear the check box, click “Next”, and then click “Remove” to complete the wizard.If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable. - -Navigate to the following directory: - -%windir%\web\printers - -If this folder exists, this is a finding. - -Determine whether Internet Printing is enabled: - -Click “Start”, click “Administrative Tools”, and then click “Server Manager”. - -Expand the roles node, right-click “Print Services”, and then select “Remove Roles Services”. - -If the Internet Printing option is enabled, this is a finding.SRG-APP-000435-WSR-000148<GroupDescription></GroupDescription>IIST-SV-000151The IIS 10.0 web server must be tuned to handle the operational requirements of the hosted application.<VulnDiscussion>A Denial of Service (DoS) can occur when the web server is overwhelmed and can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002385Access the IIS 10.0 web server registry. - -Verify the following keys are present and configured. The required setting depends upon the requirements of the application. These settings must be explicitly configured to show a conscientious tuning has been made. - -Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\ - -Configure the following registry keys to levels to accommodate the hosted applications. - -"URIEnableCache" -"UriMaxUriBytes" -"UriScavengerPeriod"If the IIS 10.0 web server is not hosting any applications, this is Not Applicable. - -If the IIS 10.0 web server is hosting applications, consult with the System Administrator to determine risk analysis performed when the application was written and deployed to the IIS 10.0 web server. - -Obtain documentation on the configuration. - -Verify, at a minimum, the following tuning settings in the registry. - -Access the IIS 10.0 web server registry. - -Verify the following keys are present and configured. The required setting depends upon the requirements of the application. - -Recommended settings are not provided as these settings must be explicitly configured to show a conscientious tuning has been made. - -Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\ -"URIEnableCache" -"UriMaxUriBytes" -"UriScavengerPeriod" - -If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.SRG-APP-000439-WSR-000152<GroupDescription></GroupDescription>IIST-SV-000152IIS 10.0 web server session IDs must be sent to the client using TLS.<VulnDiscussion>The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002418Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select "system.webServer/asp". - -Expand the "session" section. - -Select "True" for the "keepSessionIdSecure" setting. - -Select "Apply" from the "Actions" pane.Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Under the "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select "system.webServer/asp". - -Expand the "session" section. - -Verify the "keepSessionIdSecure" is set to "True". - -If the "keepSessionIdSecure" is not set to "True", this is a finding.SRG-APP-000439-WSR-000156<GroupDescription></GroupDescription>IIST-SV-000153An IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.<VulnDiscussion>TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. - -NIST SP 800-52 specifies the preferred configurations for government systems. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002418Access the IIS 10.0 Web Server. - -Access an administrator command prompt and type "regedit <enter>" to access the server's registry. - -Navigate to the following registry paths and configure the "DisabledByDefault" REG_DWORD with the appropriate values: - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server - -With a REG_DWORD value of "0" for "DisabledByDefault" - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server - -With a REG_DWORD value of "1" for "DisabledByDefault" - -With a REG_DWORD value of "0" for "Enabled"Access the IIS 10.0 Web Server. - -Access an administrator command prompt and type "regedit <enter>" to access the server's registry. - -Navigate to: -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server - -Verify a REG_DWORD value of "0" for "DisabledByDefault" - -Navigate to: -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server - -HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server - -Verify a REG_DWORD value of "1" for "DisabledByDefault" -Verify a REG_DWORD value of "0" for "Enabled" - -If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.SRG-APP-000439-WSR-000156<GroupDescription></GroupDescription>IIST-SV-000154The IIS 10.0 web server must maintain the confidentiality of controlled information during transmission through the use of an approved Transport Layer Security (TLS) version.<VulnDiscussion>TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2-approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled. - -NIST SP 800-52 defines the approved TLS versions for government applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-002418Configure the web server to use an approved TLS version according to NIST SP 800-52 and to disable all non-approved versions.Review the web server documentation and deployed configuration to determine which version of TLS is being used. - -If the TLS version is not TLS 1.2 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.SRG-APP-000516-WSR-000079<GroupDescription></GroupDescription>IIST-SV-000156All accounts installed with the IIS 10.0 web server software and tools must have passwords assigned and default passwords changed.<VulnDiscussion>During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. - -The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc. - -Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000366Access the IIS 10.0 web server. - -Access the "Apps" menu. Under Administrative Tools, select Computer Management. - -In left pane, expand "Local Users and Groups" and click on "Users". - -Change passwords for any local accounts present that are used by IIS 10.0, then verify with System Administrator default passwords have been changed. - -Develop an internal process for changing passwords on a regular basis.Access the IIS 10.0 web server. - -Access the "Apps" menu. Under "Administrative Tools", select "Computer Management". - -In left pane, expand "Local Users and Groups" and click "Users". - -Review the local users listed in the middle pane. - -If any local accounts are present and used by IIS 10.0, verify with System Administrator that default passwords have been changed. - -If passwords have not been changed from the default, this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SV-000158Unspecified file extensions on a production IIS 10.0 web server must be removed.<VulnDiscussion>By allowing unspecified file extensions to execute, the web servers attack surface is significantly increased. This increased risk can be reduced by only allowing specific ISAPI extensions or CGI extensions to run on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000366Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "ISAPI and CGI restrictions" icon. - -Click "Edit Feature Settings". - -Remove the check from the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes. - -Click "OK".Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "ISAPI and CGI restrictions" icon. - -Click “Edit Feature Settings". - -Verify the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are NOT checked. - -If either or both of the "Allow unspecified CGI modules" and the "Allow unspecified ISAPI modules" check boxes are checked, this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SV-000159The IIS 10.0 web server must have a global authorization rule configured to restrict access.<VulnDiscussion>Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000366Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the "Authorization Rules" icon. - -Remove all users other than "Administrator".Open the IIS 10.0 Manager. - -Click the IIS 10.0 web server name. - -Double-click the ".NET Authorization Rules" icon. - -If any user other than "Administrator" is listed, this is a finding. - -If .NET is not installed, this is Not Applicable.SRG-APP-000001-WSR-000001<GroupDescription></GroupDescription>IIST-SV-000200The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.<VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000054Access the IIS 10.0 IIS Manager. - -Click the IIS 10.0 server. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". - -Expand "siteDefaults". -Expand "limits". - -Set the "maxconnections" parameter to a value greater than zero.Access the IIS 10.0 IIS Manager. - -Click the IIS 10.0 server. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". - -Expand "siteDefaults". -Expand "limits". - -Review the results and verify the value is greater than zero for the "maxconnections" parameter. - -If the maxconnections parameter is set to zero, this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SV-000205The IIS 10.0 web server must enable HTTP Strict Transport Security (HSTS).<VulnDiscussion>HTTP Strict Transport Security (HSTS) ensures browsers always connect to a website over TLS. HSTS exists to remove the need for redirection configurations. HSTS relies on the browser, web server, and a public "Whitelist". If the browser does not support HSTS, it will be ignored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000366Access the IIS 10.0 Web Server. - -Access an administrative command prompt and type the following commands, substituting proper domain name: - -%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.enabled:True" /commit:apphost -%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.max-age:480" /commit:apphost -%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.includeSubDomains:True" /commit:apphost -%systemroot%\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.redirectHttpToHttps:True" /commit:apphostAccess the IIS 10.0 Web Server. - -Open IIS Manager. - -In the "Connections" pane, select the server name. - -In the "Features View" pane, open "HTTP Response Headers". - -Verify an entry exists named "Strict-Transport-Security". - -Open "Strict-Transport-Security" and verify the value box contains a value greater than 0. - -Click "OK". - -If HSTS has not been enabled, this is a finding. -The recommended max age is 8 minutes (480 seconds) or greater. Any value greater than 0 is not a finding. -If the version of Windows Server does not natively support HSTS, this is not a finding.SRG-APP-000141<GroupDescription></GroupDescription>IIST-SV-000160An IIS Server configured to be a SMTP relay must require authentication.<VulnDiscussion>Anonymous SMTP relays are strictly prohibited. An anonymous SMTP relay can be a vector for many types of malicious activity not limited to server exploitation for the sending of SPAM mail, access to emails, phishing, DoS attacks, etc. Enabling TLS, authentication, and strictly assigning IP addresses that can communicate with the relay greatly reduce the risk of the implementation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 ServerDISADPMS TargetIIS 10.0 Server3535CCI-000381Configure the relay server with a specific allowed IP address, from the same network as the relay, and implement TLS.Interview the System Administrator about the role of the IIS 10.0 web server. - -If the IIS 10.0 web server is running SMTP relay services, have the SA provide supporting documentation on how the server is hardened. A DoD-issued certificate, and specific allowed IP address should be configured. - -If the IIS web server is not running SMTP relay services, this is Not Applicable. - -If the IIS web server running SMTP relay services without TLS enabled, this is a finding. - -If the IIS web server running SMTP relay services is not configured to only allow a specific IP address, from the same network as the relay, this is a finding. diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R2_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R2_Manual-xccdf.log similarity index 63% rename from source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R2_Manual-xccdf.log rename to source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R2_Manual-xccdf.log index 52cdaafd4..57aba4e70 100644 --- a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_V1R2_Manual-xccdf.log +++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R2_Manual-xccdf.log @@ -1,3 +1,3 @@ -V-100191::System Administrator::"" -V-100223::System Administrator::"" -V-100229::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length approved by the ISSO, this is a finding. +V-218751::System Administrator::"" +V-218735::System Administrator::"" +V-218754::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length approved by the ISSO, this is a finding. diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R2_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R2_Manual-xccdf.xml new file mode 100644 index 000000000..4d2f48da3 --- /dev/null +++ b/source/StigData/Archive/Web Server/U_MS_IIS_10-0_Site_STIG_V2R2_Manual-xccdf.xml @@ -0,0 +1,1254 @@ +acceptedMicrosoft IIS 10.0 Site Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 23 Apr 20213.2.2.360791.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-APP-000001-WSR-000002<GroupDescription></GroupDescription>IIST-SI-000201The IIS 10.0 website session state must be enabled.<VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is either stored in a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials. - -When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised. - -ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000054Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Under the "ASP.NET" section, select "Session State". - -Under "Session State Mode Settings", verify the "In Process" mode is selected. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Under the "ASP.NET" section, select "Session State". - -Under "Session State Mode Settings", verify the "In Process" mode is selected. - -If the "Session State Mode Settings" is set to "In Process", this is not a finding. - -Alternative method: - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Verify the "mode" reflects "InProc". - -If the "mode" is not set to "InProc", this is a finding. - -If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.SRG-APP-000001-WSR-000002<GroupDescription></GroupDescription>IIST-SI-000202The IIS 10.0 website session state cookie settings must be configured to Use Cookies mode.<VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials. - -When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised. - -ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session and provides the ability to persist variable values for the duration of that session. - -When using the URI mode for cookie settings under session state, IIS will reject and reissue session IDs that do not have active sessions. Configuring IIS to expire session IDs and regenerate tokens gives a potential attacker less time to capture a cookie and gain access to server content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000054Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Under the ASP.NET section, select "Session State". - -Under "Cookie Settings", select the "Use Cookies" from the "Mode:" drop-down list. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: -Open the IIS 10.0 Manager. -Click the site name. -Under the "ASP.NET" section, select "Session State". -Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list. -If the "Use Cookies" mode is selected, this is not a finding. - -Alternative method: -Click the site name. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". -Verify the "cookieless" is set to "UseCookies". -If the "cookieless" is not set to "UseCookies", this is a finding. -Note: If IIS 10.0 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.SRG-APP-000014-WSR-000006<GroupDescription></GroupDescription>IIST-SI-000203A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. - -NIST SP 800-52 specifies the preferred configurations for government systems. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000068Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Select "Require SSL" check box. - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. - -Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. -Click the site name. -Double-click the "SSL Settings" icon. -Verify "Require SSL" check box is selected. - -If the "Require SSL" check box is not selected, this is a finding.SRG-APP-000014-WSR-000006<GroupDescription></GroupDescription>IIST-SI-000204A public IIS 10.0 website must only accept Secure Socket Layer (SSL) connections when authentication is required.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. - -NIST SP 800-52 specifies the preferred configurations for government systems. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000068Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Select "Require SSL" check box. - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Verify "Require SSL" check box is selected. - -If the "Require SSL" check box is not selected, this is a finding.SRG-APP-000092-WSR-000055<GroupDescription></GroupDescription>IIST-SI-000206Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.<VulnDiscussion>Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process. - -In IIS 10.0, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time. - -Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000139CCI-001464Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Click the "Logging" icon. - -Under Log Event Destination, select the "Both log file and ETW event" radio button. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Click the "Logging" icon. - -Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected. - -If the "Both log file and ETW event" radio button is not selected, this is a finding. - -Note: "Microsoft-IIS-Logging/logs" must be enabled prior to configuring this setting. More configuration information is available at: -https://blogs.intelink.gov/blogs/_disairrt/?p=1317SRG-APP-000098-WSR-000060<GroupDescription></GroupDescription>IIST-SI-000208An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Ascertaining the correct source (e.g., source IP), of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the loggable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise. - -A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000133Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 10.0 web server transparently.Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy. - -If the IIS 10.0 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Click the "Logging" icon. - -Click "View log file". - -When log file is displayed, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server. - -If the website is not behind a load balancer or proxy server, this is Not Applicable. - -If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding. - -If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.SRG-APP-000099-WSR-000061<GroupDescription></GroupDescription>IIST-SI-000209The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the loggable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise. - -Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000134Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Select the website being reviewed. - -Under "IIS", double-click the "Logging" icon. - -Configure the "Format:" under "Log File" to "W3C". - -Select "Fields". - -Under "Custom Fields", select the following fields: - -Request Header >> Connection - -Request Header >> Warning - -Click "OK". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Select the website being reviewed. - -Under "IIS", double-click the "Logging" icon. - -Verify the "Format:" under "Log File" is configured to "W3C". - -Select "Fields". - -Under "Custom Fields", verify the following fields are selected: - -Request Header >> Connection - -Request Header >> Warning - -If any of the above fields are not selected, this is a finding.SRG-APP-000100-WSR-000064<GroupDescription></GroupDescription>IIST-SI-000210The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools. - -Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001487Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 web server IIS 10.0 Manager. - -Select the website being reviewed. - -Under "IIS", double-click the "Logging" icon. - -Configure the "Format:" under "Log File" to "W3C". - -Select "Fields". - -Under "Standard Fields", select "User Agent", "User Name", and "Referrer". - -Under "Custom Fields", select the following fields: - -Request Header >> Authorization - -Response Header >> Content-Type - -Click "OK". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 web server IIS 10.0 Manager. - -Under "IIS", double-click the "Logging" icon. - -Verify the "Format:" under "Log File" is configured to "W3C". - -Select "Fields". - -Under "Standard Fields", verify "User Agent", "User Name", and "Referrer" are selected. - -Under "Custom Fields", verify the following fields have been configured: - -Request Header >> Authorization - -Response Header >> Content-Type - -If any of the above fields are not selected, this is a finding.SRG-APP-000141-WSR-000081<GroupDescription></GroupDescription>IIST-SI-000214The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.<VulnDiscussion>Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or could use the function in an unintentional manner. - -A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. - -A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click on the IIS 10.0 site. - -Under IIS, double-click the “MIME Types” icon. - -From the "Group by:" drop-down list, select "Content Type". - -From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions: - -.exe -.dll -.com -.bat -.csh - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click on the IIS 10.0 site. - -Under IIS, double-click the “MIME Types” icon. - -From the "Group by:" drop-down list, select "Content Type". - -From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: - -.exe -.dll -.com -.bat -.csh - -If any OS shell MIME types are configured, this is a finding.SRG-APP-000141-WSR-000082<GroupDescription></GroupDescription>IIST-SI-000215Mappings to unused and vulnerable scripts on the IIS 10.0 website must be removed.<VulnDiscussion>IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings. - -For Handler Mappings, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8. Handler Mappings at the site level take precedence over Handler Mappings at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click "Handler Mappings". - -Remove any script file extensions listed on the black list that are enabled. - -Select "Apply" from the "Actions" pane.For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 10.0. Handler Mappings at the site level take precedence over Handler Mappings at the server level. - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click "Handler Mappings". - -If any script file extensions from the black list are enabled, this is a finding.SRG-APP-000141-WSR-000083<GroupDescription></GroupDescription>IIST-SI-000216The IIS 10.0 website must have resource mappings set to disable the serving of certain file types.<VulnDiscussion>IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings. - -For Request Filtering, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name to review. - -Double-click Request Filtering->File Name Extensions Tab->Deny File Name Extension. - -Add any script file extensions listed on the black list that are not listed. - -Select "Apply" from the "Actions" pane.For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name to review. - -Double-click Request Filtering->File Name Extensions Tab. - -If any script file extensions from the black list are not denied, this is a finding.SRG-APP-000141-WSR-000085<GroupDescription></GroupDescription>IIST-SI-000217The IIS 10.0 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.<VulnDiscussion>A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. - -WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access Server Manager on the IIS 10.0 website. - -Select the "Local Server". - -Click "Manage". - -Select "Add Roles and Features". - -Click "Next" in the "Before you begin" dialog box. - -Select "Role-based or feature-based installation" in the "Installation Type" dialog box and click "Next". - -Select the IIS 10.0 web server on the "Server Selection" dialog box. - -From the "Windows Features" dialog box, navigate to "World Wide Web Services" >> "Common HTTP Features". - -De-select "WebDAV Publishing" and click "Next" to complete removing the WebDAV Publishing feature from the IIS 10.0 web server. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Select the IIS 10.0 website. - -Review the features listed under the "IIS" section. - -If the "WebDAV Authoring Rules" icon exists, this is a finding.SRG-APP-000142-WSR-000089<GroupDescription></GroupDescription>IIST-SI-000219Each IIS 10.0 website must be assigned a default host header.<VulnDiscussion>The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to use, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address. - -Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000382Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Right-click on the site name under review. - -Select "Edit Bindings". - -Assign hostname entries and unique IP addresses to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used. - -Click "OK". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. -Right-click on the site name under review. -Select "Edit Bindings". - -Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. Other approved and documented ports may be used. - -If both hostname entries and unique IP addresses are not configured to port 80 for HTTP and port 443 for HTTPS (or other approved and documented port), this is a finding. - -Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding. - -Note: If HTTP/Port 80 is not being used, and is not configured as above, this is not a finding. - -Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.SRG-APP-000172-WSR-000104<GroupDescription></GroupDescription>IIST-SI-000220A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.<VulnDiscussion>A DoD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites. - -Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000197CCI-001188CCI-002470Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. -Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Double-click the "SSL Settings" icon. - -Verify the "Clients Certificate Required" check box is selected. - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. -Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Double-click the "SSL Settings" icon. - -Verify the "Clients Certificate Required" check box is selected. - -If the "Clients Certificate Required" check box is not selected, this is a finding.SRG-APP-000211-WSR-000031<GroupDescription></GroupDescription>IIST-SI-000221Anonymous IIS 10.0 website access accounts must be restricted.<VulnDiscussion>Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data stored on the web server must be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001082Remove the Anonymous access account from all privileged accounts and all privileged groups.Check the account used for anonymous access to the website. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: -Open the IIS 10.0 Manager. - -Double-click "Authentication" in the IIS section of the website’s Home Pane. - -If Anonymous access is disabled, this is Not a Finding. - -If Anonymous access is enabled, click "Anonymous Authentication". - -Click "Edit" in the "Actions" pane. - -If the "Specific user" radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note: account name. - -Check privileged groups that may allow the anonymous account inappropriate membership: -Open "Server Manager" on the machine. - -Expand Configuration. - -Expand Local Users and Groups. - -Click "Groups". - -Review members of any of the following privileged groups: - -Administrators -Backup Operators -Certificate Services (of any designation) -Distributed COM Users -Event Log Readers -Network Configuration Operators -Performance Log Users -Performance Monitor Users -Power Users -Print Operators -Remote Desktop Users -Replicator - -Double-click each group and review its members. - -If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.SRG-APP-000224-WSR-000136<GroupDescription></GroupDescription>IIST-SI-000223The IIS 10.0 website must generate unique session identifiers that cannot be reliably reproduced.<VulnDiscussion>Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. To maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application. - -By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID. - -The session ID generator must be a FIPS 140-2-approved generator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001188Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Under the ASP.NET section, select "Session State". - -Under "Session State" Mode Settings, select the "In Process" mode.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Under the "ASP.NET" section, select "Session State". - -Under "Session State" Mode Settings, verify the "In Process" mode is selected. - -If the "In Process" mode is selected, this is not a finding. - -Alternative method: - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Verify the "mode" reflects "InProc". - -If the "mode" is not set to "InProc", this is a finding. - -If the system being reviewed is part of a Web Farm, interview the System Administrator to ensure Session State Tracking is enabled via a SQL server, or other means. If Session State Tracking is enabled on the Web Farm, this is not a finding.SRG-APP-000233-WSR-000146<GroupDescription></GroupDescription>IIST-SI-000224The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.<VulnDiscussion>The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file, the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001084Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Click the "Advanced Settings" from the "Actions" pane. - -Change the Physical Path to the new partition and directory location.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Click the "Advanced Settings" from the "Actions" pane. - -Review the Physical Path. - -If the Path is on the same partition as the OS, this is a finding. - -Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IIST-SI-000225The IIS 10.0 website must be configured to limit the maxURL.<VulnDiscussion>Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001094Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -Set the "maxURL" value to "4096" or less.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -If the "maxUrl" value is not set to "4096" or less, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IIST-SI-000226The IIS 10.0 website must be configured to limit the size of web requests.<VulnDiscussion>By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001094Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -Set the "maxAllowedContentLength" value to "30000000" or less.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IIST-SI-000227The IIS 10.0 websites Maximum Query String limit must be configured.<VulnDiscussion>Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001094Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -Set the "Maximum Query String" value to "2048" or less.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If the "Maximum Query String" value is not set to "2048" or less, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IIST-SI-000228Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.<VulnDiscussion>Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001094Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -Uncheck the "Allow high-bit characters" check box.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -If the "Allow high-bit characters" check box is checked, this is a finding. - -Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IIST-SI-000229Double encoded URL requests must be prohibited by any IIS 10.0 website.<VulnDiscussion>Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. Setting limits on web requests ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the "Allow double escaping" option is disabled, it prevents attacks that rely on double-encoded requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001094Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -Uncheck the "Allow double escaping" check box.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -If the "Allow double escaping" check box is checked, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IIST-SI-000230Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.<VulnDiscussion>Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the "File Extensions Request" filter enables rejection of requests containing specific file extensions not defined in the "File Extensions" filter. Tripping this filter will cause IIS to generate a Status Code 404.7.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001094Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -Uncheck the "Allow unlisted file extensions" check box.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Double-click the "Request Filtering" icon. - -Click "Edit Feature Settings" in the "Actions" pane. - -If the "Allow unlisted file name extensions" check box is checked, this is a finding. - -Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.SRG-APP-000251-WSR-000157<GroupDescription></GroupDescription>IIST-SI-000231Directory Browsing on the IIS 10.0 website must be disabled.<VulnDiscussion>Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001310Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the Site. - -Double-click the "Directory Browsing" icon. - -Under the "Actions" pane, click "Disabled".Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Click the Site. - -Double-click the "Directory Browsing" icon. - -If "Directory Browsing" is not installed, this is Not Applicable. - -Under the "Actions" pane, verify "Directory Browsing" is "Disabled". - -If "Directory Browsing" is not "Disabled", this is a finding.SRG-APP-000266-WSR-000159<GroupDescription></GroupDescription>IIST-SI-000233Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 website, patches, loaded modules, and directory paths.<VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001312Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Error Pages" icon. - -Click each error message and click "Edit Feature" Setting from the "Actions" pane; set each error message to "Detailed errors for local requests and custom error pages for remote requests".Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click the "Error Pages" icon. - -Click each error message and click "Edit Feature" setting from the "Actions" pane. - -If any error message is not set to "Detailed errors for local requests and custom error pages for remote requests", this is a finding.SRG-APP-000266-WSR-000160<GroupDescription></GroupDescription>IIST-SI-000234Debugging and trace information used to diagnose the IIS 10.0 website must be disabled.<VulnDiscussion>Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001312Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click ".NET Compilation". - -Scroll down to the "Behavior" section and set the value for "Debug" to "False".Note: If the ".NET feature" is not installed, this check is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Double-click ".NET Compilation". - -Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False". - -If the "Debug" value is not set to "False", this is a finding.SRG-APP-000295-WSR-000012<GroupDescription></GroupDescription>IIST-SI-000235The Idle Time-out monitor for each IIS 10.0 website must be enabled.<VulnDiscussion>The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received. - -The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes. - -By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002361Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the Application Pools. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and set the value for "Idle Time-out" to something other than "0". "20" or less is recommended if the amount of RAM on the system is limited.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. -Click the Application Pools. -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. -Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is not "0". - -If the "Idle Time-out" is set to "0", this is a finding.SRG-APP-000295-WSR-000134<GroupDescription></GroupDescription>IIST-SI-000236The IIS 10.0 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.<VulnDiscussion>Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed. - -Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002361Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Set the "timeout" to "00:20:00 or less”, using the lowest value possible depending upon the application. -Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications. - -In the "Actions" pane, click "Apply".Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Verify the "timeout" is set to "00:20:00 or less”, using the lowest value possible depending upon the application. -Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications. - -If "timeout" is not set to "00:20:00 or less”, this is a finding.SRG-APP-000316-WSR-000170<GroupDescription></GroupDescription>IIST-SI-000237The IIS 10.0 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.<VulnDiscussion>During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack. - -The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list. - -The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002322Prepare documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps: - -Determine the respective website for the application at risk of an attack. - -Access the IIS 10.0 web server IIS 10.0 Manager. - -Select the respective website. - -In the "Actions" pane, under "Manage Website", click "Stop". - -If necessary, stop all websites. - -If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager. - -In the "Actions" pane, under "Manage Server", click "Stop".Interview the System Administrator and Web Manager. - -Ask for documentation for the IIS 10.0 web server administration. - -Verify there are documented procedures for shutting down an IIS 10.0 website in the event of an attack. The procedure should, at a minimum, provide the following steps: - -Determine the respective website for the application at risk of an attack. - -Access the IIS 10.0 web server IIS 10.0 Manager. - -Select the respective website. - -In the "Actions" pane, under "Manage Website", click "Stop". - -If necessary, stop all websites. - -If necessary, stop the IIS 10.0 web server by selecting the web server in the IIS 10.0 Manager. - -In the "Actions" pane, under "Manage Server", click "Stop". - -If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.SRG-APP-000357-WSR-000150<GroupDescription></GroupDescription>IIST-SI-000238The IIS 10.0 website must use a logging mechanism configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 10.0 website.<VulnDiscussion>To make certain the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism must be able to allocate log record storage capacity. - -The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001849Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Under "IIS" double-click on the "Logging" icon. - -If necessary, in the "Logging" configuration box, redesignate a log path to a location able to house the logs. - -Under "Log File Rollover", deselect the "Do not create new log files" setting. - -Configure a schedule to rollover log files on a regular basis.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 web server IIS 10.0 Manager. - -Under "IIS" double-click on the "Logging" icon. - -In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written. - -Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging. - -Under "Log File Rollover", verify "Do not create new log files" is not selected. - -Verify a schedule is configured to rollover log files on a regular basis. - -Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 10.0 web server to another logging device. - -If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.SRG-APP-000383-WSR-000175<GroupDescription></GroupDescription>IIST-SI-000239The IIS 10.0 websites must use ports, protocols, and services according to Ports, Protocols, and Services Management (PPSM) guidelines.<VulnDiscussion>Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system. - -The web server must provide the capability to disable or deactivate network-related services deemed to be non-essential to the server mission, too unsecure, or prohibited by the PPSM CAL and vulnerability assessments. - -Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS. - -The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, PPSM, and the associated PPS Assurance Category Assignments List.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-001762Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -In the "Action" Pane, click "Bindings". - -Edit to change an existing binding and set the correct ports and protocol.Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -In the "Action" Pane, click "Bindings". - -Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.SRG-APP-000427-WSR-000186<GroupDescription></GroupDescription>IIST-SI-000241The IIS 10.0 website must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).<VulnDiscussion>The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002470Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the Server name. - -Double-click "Server Certificates". - -Click "Import" under the "Actions" pane. - -Browse to the DoD certificate location, select it, and click "OK". - -Remove any non-DoD certificates if present. - -Click on the site needing the certificate. - -Select "Bindings" under the "Actions" pane. - -Click on the binding needing a certificate and select "Edit", or add a site binding for HTTPS. - -Assign the certificate to the website by choosing it under the "SSL Certificate" drop-down and clicking "OK".Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Click the site name under review. - -Click "Bindings" in the "Action" Pane. - -Click the "HTTPS type" from the box. - -Click "Edit". - -Click "View" and then review and verify the certificate path. - -If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding. - -If HTTPS is not an available type under site bindings, this is a finding. - -If HTTPS is not an available type under site bindings, and the Web Server ONLY communicates directly with a load balancer/proxy server with IP address and Domain Restrictions in place, this is not a finding.SRG-APP-000429-WSR-000113<GroupDescription></GroupDescription>IIST-SI-000242The IIS 10.0 private website must employ cryptographic mechanisms (TLS) and require client certificates.<VulnDiscussion>When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server. - -Satisfies: SRG-APP-000429-WSR-000113, SRG-APP-000439-WSR-000151, SRG-APP-000441-WSR-000181, SRG-APP-000442-WSR-000182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002476Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. - -Double-click the "SSL Settings" icon under the "IIS" section. - -Select the "Require SSL" setting. - -Select the "Client Certificates Required" setting. - -Click "Apply" in the "Actions" pane. - -Click the site under review. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access". - -Click on the drop-down list for "sslFlags". - -Select the "Ssl128" check box. - -Click "Apply" in the "Actions" pane.Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server. - -Note: If this is a public facing web server, this requirement is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Open the IIS 10.0 Manager. -Double-click the "SSL Settings" icon under the "IIS" section. -Verify "Require SSL" is checked. -Verify "Client Certificates Required" is selected. -Click the site under review. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate "system.webServer/security/access". -The value for "sslFlags" set must include "ssl128". - -If the "Require SSL" is not selected, this is a finding. -If the "Client Certificates Required" is not selected, this is a finding. -If the "sslFlags" is not set to "ssl128", this is a finding.SRG-APP-000439-WSR-000152<GroupDescription></GroupDescription>IIST-SI-000244IIS 10.0 website session IDs must be sent to the client using TLS.<VulnDiscussion>The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002418Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 Manager. - -Select the website being reviewed. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select "system.webServer/asp". - -Expand the "session" section. - -Select "True" for the "keepSessionIdSecure" setting. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 Manager. - -Select the website being reviewed. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select "system.webServer/asp". - -Expand the "session" section. - -Verify the "keepSessionIdSecure" is set to "True". - -If the "keepSessionIdSecure" is not set to "True", this is a finding.SRG-APP-000439-WSR-000154<GroupDescription></GroupDescription>IIST-SI-000246Cookies exchanged between the IIS 10.0 website and the client must have cookie properties set to prohibit client-side scripts from reading the cookie data.<VulnDiscussion>A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e., HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie. - -Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-002418Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 Manager. -Under "Management" section, double-click the "Configuration Editor" icon. -From the "Section:" drop-down list, select "system.web/httpCookies". -Set the "require SSL" to "True". - -From the "Section:" drop-down list, select "system.web/sessionState". -Set the "compressionEnabled" to "False". - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. -Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server. - -Follow the procedures below for each site hosted on the IIS 10.0 web server: - -Access the IIS 10.0 Manager. -Under the "Management" section, double-click the "Configuration Editor" icon. -From the "Section:" drop-down list, select "system.web/httpCookies". -Verify the "require SSL" is set to "True". - -From the "Section:" drop-down list, select "system.web/sessionState". -Verify the "compressionEnabled" is set to "False". - -If both the "system.web/httpCookies:require SSL" is set to "True" and the "system.web/sessionState:compressionEnabled" is set to "False", this is not a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000251The IIS 10.0 website must have a unique application pool.<VulnDiscussion>Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click the site name under review. - -Assign a unique application pool to each website.Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Click "Application Pools". - -In the list of Application Pools, review the "Applications" column and verify unique application pools for each website. - -If any Application Pools are being used for more than one website, this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000252The maximum number of requests an application pool can process for each IIS 10.0 website must be explicitly set.<VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click "Application Pools". - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -Scroll down to the "Recycling section" and set the value for "Request Limit" to greater than "0". - -Click "OK".Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Perform for each Application Pool. - -Click "Application Pools". - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0". - -If the "Request Limit" is set to a value of "0", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000253The amount of virtual memory an application pool uses for each IIS 10.0 website must be explicitly set.<VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click “Application Pools”. - -Perform the following for each Application Pool: - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -In the "Advanced Settings" dialog box scroll down to the "Recycling" section and set the value for "Virtual Memory Limit" to a value other than "0". - -Click "OK".Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Perform the following for each Application Pool: - -Click "Application Pools". - -Highlight an Application Pool and click "Advanced Settings" in the Action Pane. - -In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to "0". - -If the value for "Virtual Memory Limit" is set to "0", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000254The amount of private memory an application pool uses for each IIS 10.0 website must be explicitly set.<VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -Scroll down to the "Recycling" section and set the value for "Private Memory Limit" to a value other than "0".Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Perform the following for each Application Pool: - -Click "Application Pools". - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0". - -If the "Private Memory Limit" is set to a value of "0", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000255The application pool for each IIS 10.0 website must have a recycle time explicitly set.<VulnDiscussion>Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section. - -Set both the "Regular time interval" and "Specific time" options to "True".Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Perform the following for each Application Pool: - -Click "Application Pools". - -Highlight an Application Pool and click "Advanced Settings" in the "Action" Pane. - -Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section. - -Verify both the "Regular time interval" and "Specific time" options are set to "True". - -If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000257The application pools pinging monitor for each IIS 10.0 website must be enabled.<VulnDiscussion>Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and set the value for "Ping Enabled" to "True". - -Click "OK".Open the Internet Information Services (IIS) Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True". - -If the value for "Ping Enabled" is not set to "True", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000258The application pools rapid fail protection for each IIS 10.0 website must be enabled.<VulnDiscussion>Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection, the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and set the value for "Enabled" to "True". - -Click "OK".Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True". - -If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000259The application pools rapid fail protection settings for each IIS 10.0 website must be managed.<VulnDiscussion>Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and set the value for "Failure Interval" to "5" or less. - -Click "OK".Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. - -If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable. - -Open the IIS 10.0 Manager. - -Click "Application Pools". - -Perform the following for each Application Pool: - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5". - -If the "Failure Interval" is not set to "5" or less, this is a finding.SRG-APP-000141-WSR-000087<GroupDescription></GroupDescription>IIST-SI-000261Interactive scripts on the IIS 10.0 web server must be located in unique and designated folders.<VulnDiscussion>CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the System Administrator (SA) control over what goes into those folders and to facilitate access control at the folder level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381All interactive programs must be placed in unique designated folders based on CGI or ASP script type. - -Open the IIS 10.0 Manager. - -Right-click the IIS 10.0 web server name and select "Explore". - -Search for the listed script extensions. - -Move each script type to its unique designated folder. - -Set the permissions to the scripts folders as follows: - -Administrators: FULL -TrustedInstaller: FULL -SYSTEM: FULL -ApplicationPoolId:READ -Custom Service Account: READ -Users: READ -ALL APPLICATION PACKAGES: READDetermine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp. - -All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders. - -Open the IIS 10.0 Manager. - -Right-click the IIS 10.0 web site name and select "Explore". - -Search for the listed script extensions. Each script type must be in its unique designated folder. - -If scripts are not segregated from web content and in their own unique folders, this is a finding.SRG-APP-000141-WSR-000087<GroupDescription></GroupDescription>IIST-SI-000262Interactive scripts on the IIS 10.0 web server must have restrictive access controls.<VulnDiscussion>CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension. - -The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the System Administrator (SA) or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp. - -If the website does not utilize CGI, this finding is NA. - -All interactive programs must have restrictive permissions. - -Open the IIS 10.0 Manager. - -Right-click the IIS 10.0 web server name and select "Explore". - -Search for the listed script extensions. - -Set the permissions to the CGI scripts as follows: - -Administrators: FULL -Web Administrators: FULL -TrustedInstaller: FULL -ALL APPLICATION PACKAGES: Read -ALL RESTRICTED APPLICATION PACKAGES: Read -SYSTEM: FULL -ApplicationPoolId: READ -Custom Service Account: READ -Users: READ -Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp. - -If the website does not utilize CGI, this finding is Not Applicable. - -All interactive programs must have restrictive permissions. - -Open the IIS 10.0 Manager. - -Right-click the IIS 10.0 web site name and select "Explore". - -Search for the listed script extensions. - -Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned. - -Administrators: FULL -Web Administrators: FULL -TrustedInstaller: FULL -ALL APPLICATION PACKAGES: Read -ALL RESTRICTED APPLICATION PACKAGES: Read -SYSTEM: FULL -ApplicationPoolId: READ -Custom Service Account: READ -Users: READ - -If the permissions are less restrictive than listed above, this is a finding. -SRG-APP-000141-WSR-000087<GroupDescription></GroupDescription>IIST-SI-000263Backup interactive scripts on the IIS 10.0 server must be removed.<VulnDiscussion>Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000381Remove the backup files from the production web server.Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. The scope of this requirement is to analyze only within the web server content directories, not the entire underlying operating system. - -If the website does not utilize CGI, this finding is Not Applicable. - -Open the IIS 10.0 Manager. - -Right-click the IIS 10.0 web site name and select "Explore". - -Search for the listed script extensions - -Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”. - -If files with these extensions are found, this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IIST-SI-000264The required DoD banner page must be displayed to authenticated users accessing a DoD private website.<VulnDiscussion>A consent banner will be in place to inform prospective entrants the website they are about to enter is a DoD website and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS 10.0 SiteDISADPMS TargetIIS 10.0 Site3537CCI-000366Configure a DoD private website to display the required DoD banner page when authentication is required for user access.Note: This requirement is only applicable for private DoD websites. - -If a banner is required, the following banner page must be in place: - -“You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - -- At any time, the USG may inspect and seize data stored on this IS. - -- Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - -- This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy. - -- Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.” - -OR - -If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner: - -"I've read & consent to terms in IS user agreem't." - -NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page. - -If the access-controlled website does not display this banner page before entry, this is a finding. diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R11_Manual-xccdf.log b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R11_Manual-xccdf.log deleted file mode 100644 index 62acf0e27..000000000 --- a/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R11_Manual-xccdf.log +++ /dev/null @@ -1,4 +0,0 @@ -V-76695::This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files::If an account associated with roles other than auditors -V-76759::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server'; ValueData = 0; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'DWORD'} -V-76745::CREATOR OWNER: Full Control, Subfolders and files only::CREATOR OWNER: Full Control - Subfolders and files only -V-76727::"system.web/sessionState"::'' diff --git a/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R11_Manual-xccdf.xml b/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R11_Manual-xccdf.xml deleted file mode 100644 index 709f52d10..000000000 --- a/source/StigData/Archive/Web Server/U_MS_IIS_8-5_Server_STIG_V1R11_Manual-xccdf.xml +++ /dev/null @@ -1,911 +0,0 @@ -acceptedIIS 8.5 Server Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 11 Benchmark Date: 24 Jul 20201I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>WN10-00-000005<GroupDescription></GroupDescription>WN10-00-000005Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.<VulnDiscussion>Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Use Windows 10 Enterprise 64-bit version for domain-joined systems.Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version. - -For standalone systems, this is NA. - -Open "Settings". - -Select "System", then "About". - -If "Edition" is not "Windows 10 Enterprise", this is a finding. - -If "System type" is not "64-bit operating system…", this is a finding.WN10-CC-000310<GroupDescription></GroupDescription>WN10-CC-000310Users must be prevented from changing installation options.<VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001812Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ - -Value Name: EnableUserControl - -Value Type: REG_DWORD -Value: 0WN10-00-000010<GroupDescription></GroupDescription>WN10-00-000010Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.<VulnDiscussion>Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366For standalone systems, this is NA. - -Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. - -For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Ensure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) - -The TPM must be enabled in the firmware. -Run "tpm.msc" for configuration options in Windows.Verify domain-joined systems have a TPM enabled and ready for use. - -For standalone systems, this is NA. - -Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. - -For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Verify the system has a TPM and is ready for use. -Run "tpm.msc". -Review the sections in the center pane. -"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". -TPM Manufacturer Information - Specific Version = 2.0 or 1.2 - -If a TPM is not found or is not ready for use, this is a finding.WN10-CC-000315<GroupDescription></GroupDescription>WN10-CC-000315The Windows Installer Always install with elevated privileges must be disabled.<VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001812Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ - -Value Name: AlwaysInstallElevated - -Value Type: REG_DWORD -Value: 0WN10-CC-000320<GroupDescription></GroupDescription>WN10-CC-000320Users must be notified if a web-based program attempts to install software.<VulnDiscussion>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Not Configured" or "Disabled".The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ - -Value Name: SafeForScripting - -Value Type: REG_DWORD -Value: 0 (or if the Value Name does not exist)WN10-CC-000325<GroupDescription></GroupDescription>WN10-CC-000325Automatically signing in the last interactive user after a system-initiated restart must be disabled.<VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: DisableAutomaticRestartSignOn - -Value Type: REG_DWORD -Value: 1WN10-CC-000330<GroupDescription></GroupDescription>WN10-CC-000330The Windows Remote Management (WinRM) client must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowBasic - -Value Type: REG_DWORD -Value: 0WN10-00-000030<GroupDescription></GroupDescription>WN10-00-000030Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.<VulnDiscussion>If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001199CCI-002475CCI-002476Enable full disk encryption on all information systems (including SIPRNet) using BitLocker. - -BitLocker, included in Windows, can be enabled in the Control Panel under "BitLocker Drive Encryption" as well as other management tools. - -NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).Verify all Windows 10 information systems (including SIPRNet) employ BitLocker for full disk encryption. - -For virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -If full disk encryption using BitLocker is not implemented, this is a finding. - -Verify BitLocker is turned on for the operating system drive and any fixed data drives. - -Open "BitLocker Drive Encryption" from the Control Panel. - -If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding. - -NOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).WN10-CC-000335<GroupDescription></GroupDescription>WN10-CC-000335The Windows Remote Management (WinRM) client must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002890CCI-003123Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowUnencryptedTraffic - -Value Type: REG_DWORD -Value: 0WN10-CC-000360<GroupDescription></GroupDescription>WN10-CC-000360The Windows Remote Management (WinRM) client must not use Digest authentication.<VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Disallow Digest authentication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowDigest - -Value Type: REG_DWORD -Value: 0WN10-00-000025<GroupDescription></GroupDescription>WN10-00-000025Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>An approved tool for continuous network scanning must be installed and configured to run. - -Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. - -To support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001233Install DoD approved HBSS software and ensure it is operating continuously.Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. - -If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.WN10-00-000035<GroupDescription></GroupDescription>WN10-00-000035The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. - -The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001774Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. - -Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows 10 Enterprise. - -If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. - -Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: - -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmThis is applicable to unclassified systems; for other systems this is NA. - -Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems. - -If an application whitelisting program is not in use on the system, this is a finding. - -Configuration of whitelisting applications will vary by the program. - -AppLocker is a whitelisting application built into Windows 10 Enterprise. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. - -If AppLocker is used, perform the following to view the configuration of AppLocker: -Run "PowerShell". - -Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: -Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml - -This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. - -Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: - -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmWN10-CC-000345<GroupDescription></GroupDescription>WN10-CC-000345The Windows Remote Management (WinRM) service must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: AllowBasic - -Value Type: REG_DWORD -Value: 0WN10-00-000040<GroupDescription></GroupDescription>WN10-00-000040Windows 10 systems must be maintained at a supported servicing level.<VulnDiscussion>Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation. - -New versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions. - -A separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Update systems on the Semi-Annual Channel to "Microsoft Windows Version 1709 (OS Build 16299.0)" or greater. - -It is recommended systems be upgraded to the most recently released version. - -Special purpose systems using the Long-Term Servicing Branch\Channel (LTSC\B) may be at the following versions: - -v1507 (Build 10240) -v1607 (Build 14393) -v1809 (Build 17763)Run "winver.exe". - -If the "About Windows" dialog box does not display: - -"Microsoft Windows Version 1803 (OS Build 17134.0)" - -or greater, this is a finding. - -Note: Microsoft has extended support for previous versions providing critical and important updates for Windows 10 Enterprise. - -Microsoft scheduled end of support dates for current Semi-Annual Channel versions: -v1709 - 13 October 2020 -v1803 - 10 November 2020 -v1809 - 13 April 2021 -v1903 - 8 December 2020 - -No preview versions will be used in a production environment. - -Special purpose systems using the Long-Term Servicing Branch\Channel (LTSC\B) may be at following versions which are not a finding: - -v1507 (Build 10240) -v1607 (Build 14393) -v1809 (Build 17763)WN10-00-000045<GroupDescription></GroupDescription>WN10-00-000045The Windows 10 system must use an anti-virus program.<VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Install an anti-virus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. - -If there is no anti-virus solution installed on the system, this is a finding.WN10-00-000050<GroupDescription></GroupDescription>WN10-00-000050Local volumes must be formatted using NTFS.<VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using the NTFS file system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213Format all local volumes to use NTFS.Run "Computer Management". -Navigate to Storage >> Disk Management. - -If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding. - -This does not apply to system partitions such the Recovery and EFI System Partition.WN10-00-000055<GroupDescription></GroupDescription>WN10-00-000055Alternate operating systems must not be permitted on the same system.<VulnDiscussion>Allowing other operating systems to run on a secure system may allow security to be circumvented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure Windows 10 is the only operating system on a device. Remove alternate operating systems.Verify the system does not include other operating system installations. - -Run "Advanced System Settings". -Select the "Advanced" tab. -Click the "Settings" button in the "Startup and Recovery" section. - -If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.WN10-00-000060<GroupDescription></GroupDescription>WN10-00-000060Non system-created file shares on a system must limit access to groups that require it.<VulnDiscussion>Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information. If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001090If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. - -Remove any unnecessary non-system created shares.Non system-created shares should not typically exist on workstations. - -If only system-created shares exist on the system this is NA. - -Run "Computer Management". -Navigate to System Tools >> Shared Folders >> Shares. - -If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA. -(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.) - -Right click any non-system-created shares. -Select "Properties". -Select the "Share Permissions" tab. - -Verify the necessity of any shares found. -If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. - -Select the "Security" tab. - -If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.WN10-00-000065<GroupDescription></GroupDescription>WN10-00-000065Unused accounts must be disabled or removed from the system after 35 days of inactivity.<VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000795Regularly review local accounts and verify their necessity. Disable or delete any active accounts that have not been used in the last 35 days.Run "PowerShell". -Copy the lines below to the PowerShell window and enter. - -"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { - $user = ([ADSI]$_.Path) - $lastLogin = $user.Properties.LastLogin.Value - $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 - if ($lastLogin -eq $null) { - $lastLogin = 'Never' - } - Write-Host $user.Name $lastLogin $enabled -}" - -This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). -For example: User1 10/31/2015 5:49:56 AM True - -Review the list to determine the finding validity for each account reported. - -Exclude the following accounts: -Built-in administrator account (Disabled, SID ending in 500) -Built-in guest account (Disabled, SID ending in 501) -Built-in DefaultAccount (Disabled, SID ending in 503) -Local administrator account - -If any enabled accounts have not been logged on to within the past 35 days, this is a finding. - -Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.WN10-00-000070<GroupDescription></GroupDescription>WN10-00-000070Only accounts responsible for the administration of a system must have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. - -System administrators must log on to systems only using accounts with the minimum level of authority necessary. - -For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. - -Standard user accounts must not be members of the local administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. - -For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. - -Remove any standard user accounts.Run "Computer Management". -Navigate to System Tools >> Local Users and Groups >> Groups. -Review the members of the Administrators group. -Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. - -For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. - -Standard user accounts must not be members of the local administrator group. - -If prohibited accounts are members of the local administrators group, this is a finding. - -The built-in Administrator account or other required administrative accounts would not be a finding.WN10-00-000075<GroupDescription></GroupDescription>WN10-00-000075Only accounts responsible for the backup operations must be members of the Backup Operators group.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Create separate accounts for backup operations for users with this privilege.Run "Computer Management". -Navigate to System Tools >> Local Users and Groups >> Groups. -Review the members of the Backup Operators group. - -If the group contains no accounts, this is not a finding. - -If the group contains any accounts, the accounts must be specifically for backup functions. - -If the group contains any standard user accounts used for performing normal user tasks, this is a finding.WN10-00-000080<GroupDescription></GroupDescription>WN10-00-000080Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.<VulnDiscussion>Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by Virtualization Based Security features such as Credential Guard on Windows 10; however, it is not the full Hyper-V installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381For Hyper-V, remove any unauthorized groups or user accounts from the "Hyper-V Administrators" group. - -For hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines. - -For Hyper-V, Run "Computer Management". -Navigate to System Tools >> Local Users and Groups >> Groups. -Double click on "Hyper-V Administrators". - -If any unauthorized groups or user accounts are listed in "Members:", this is a finding. - -For hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application. - -If any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding. - -All users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.WN10-00-000085<GroupDescription></GroupDescription>WN10-00-000085Standard local user accounts must not exist on a system in a domain.<VulnDiscussion>To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log onto workstations in a domain with their domain accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.Run "Computer Management". -Navigate to System Tools >> Local Users and Groups >> Users. - -If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. - -Built-in Administrator account (Disabled) -Built-in Guest account (Disabled) -Built-in DefaultAccount (Disabled) -Built-in defaultuser0 (Disabled) -Built-in WDAGUtilityAccount (Disabled) -Local administrator account(s) - -All of the built-in accounts may not exist on a system, depending on the Windows 10 version.WN10-CC-000350<GroupDescription></GroupDescription>WN10-CC-000350The Windows Remote Management (WinRM) service must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002890CCI-003123Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: AllowUnencryptedTraffic - -Value Type: REG_DWORD -Value: 0WN10-00-000090<GroupDescription></GroupDescription>WN10-00-000090Accounts must be configured to require password expiration.<VulnDiscussion>Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000199Configure all passwords to expire. -Run "Computer Management". -Navigate to System Tools >> Local Users and Groups >> Users. -Double click each active account. -Ensure "Password never expires" is not checked on all active accounts.Run "Computer Management". -Navigate to System Tools >> Local Users and Groups >> Users. -Double click each active account. - -If "Password never expires" is selected for any account, this is a finding.WN10-00-000095<GroupDescription></GroupDescription>WN10-00-000095Permissions for system files and directories must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002165Maintain the default file system permissions and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN10-SO-000160).The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160). - -If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding. - -Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) - -Viewing in File Explorer: -Select the "Security" tab, and the "Advanced" button. - -C:\ -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Administrators - Full control - This folder, subfolders and files -SYSTEM - Full control - This folder, subfolders and files -Users - Read & execute - This folder, subfolders and files -Authenticated Users - Modify - Subfolders and files only -Authenticated Users - Create folders / append data - This folder only - -\Program Files -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files - -\Windows -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files - -Alternately use icacls. - -Run "CMD" as administrator. -Enter "icacls" followed by the directory. - -icacls c:\ -icacls "c:\program files" -icacls c:\windows - -The following results will be displayed as each is entered: - -c:\ -BUILTIN\Administrators:(OI)(CI)(F) -NT AUTHORITY\SYSTEM:(OI)(CI)(F) -BUILTIN\Users:(OI)(CI)(RX) -NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) -NT AUTHORITY\Authenticated Users:(AD) -Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) -Successfully processed 1 files; Failed processing 0 files - -c:\program files -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - -c:\windows -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 filesWN10-CC-000355<GroupDescription></GroupDescription>WN10-CC-000355The Windows Remote Management (WinRM) service must not store RunAs credentials.<VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Disallow WinRM from storing RunAs credentials" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: DisableRunAs - -Value Type: REG_DWORD -Value: 1WN10-00-000100<GroupDescription></GroupDescription>WN10-00-000100Internet Information System (IIS) or its subcomponents must not be installed on a workstation.<VulnDiscussion>Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.IIS is not installed by default. Verify it has not been installed on the system. - -Run "Programs and Features". -Select "Turn Windows features on or off". - -If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding. - -If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO. In addition, any applicable requirements from the IIS STIG must be addressed.WN10-00-000105<GroupDescription></GroupDescription>WN10-00-000105Simple Network Management Protocol (SNMP) must not be installed on the system.<VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000382Uninstall "Simple Network Management Protocol (SNMP)" from the system. - -Run "Programs and Features". -Select "Turn Windows Features on or off". -De-select "Simple Network Management Protocol (SNMP)"."SNMP" is not installed by default. Verify it has not been installed. - -Navigate to the Windows\System32 directory. - -If the "SNMP" application exists, this is a finding.WN10-00-000110<GroupDescription></GroupDescription>WN10-00-000110Simple TCP/IP Services must not be installed on the system.<VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Uninstall "Simple TCPIP Services (i.e. echo, daytime etc)" from the system. - -Run "Programs and Features". -Select "Turn Windows Features on or off". -De-select "Simple TCPIP Services (i.e. echo, daytime etc)"."Simple TCP/IP Services" is not installed by default. Verify it has not been installed. - -Run "Services.msc". - -If "Simple TCP/IP Services" is listed, this is a finding.WN10-00-000115<GroupDescription></GroupDescription>WN10-00-000115The Telnet Client must not be installed on the system.<VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000382Uninstall "Telnet Client" from the system. - -Run "Programs and Features". -Select "Turn Windows Features on or off". - -De-select "Telnet Client".The "Telnet Client" is not installed by default. Verify it has not been installed. - -Navigate to the Windows\System32 directory. - -If the "telnet" application exists, this is a finding.WN10-00-000120<GroupDescription></GroupDescription>WN10-00-000120The TFTP Client must not be installed on the system.<VulnDiscussion>Some protocols and services do not support required security features, such as encrypting passwords or traffic.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000382Uninstall "TFTP Client" from the system. - -Run "Programs and Features". -Select "Turn Windows Features on or off". - -De-select "TFTP Client".The "TFTP Client" is not installed by default. Verify it has not been installed. - -Navigate to the Windows\System32 directory. - -If the "TFTP" application exists, this is a finding.WN10-00-000130<GroupDescription></GroupDescription>WN10-00-000130Software certificate installation files must be removed from Windows 10.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. - -Note: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.Search all drives for *.p12 and *.pfx files. - -If any files with these extensions exist, this is a finding. - -This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.WN10-00-000135<GroupDescription></GroupDescription>WN10-00-000135A host-based firewall must be installed and enabled on the system.<VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Install and enable a host-based firewall on the system.Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. - -The configuration requirements will be determined by the applicable firewall STIG.WN10-00-000140<GroupDescription></GroupDescription>WN10-00-000140Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.<VulnDiscussion>Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote management systems will help limit this exposure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts. - -Configure only inbound connection exceptions for authorized remote management hosts. -Computer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane) - -For any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles. - -If a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts. - -If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding. - -Review inbound firewall exceptions. -Computer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane) - -For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles. - -If a third-party firewall is used, ensure comparable settings are in place.WN10-AC-000005<GroupDescription></GroupDescription>WN10-AC-000005Windows 10 account lockout duration must be configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. - -A value of "0" is also acceptable, requiring an administrator to unlock the account.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. - -Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.WN10-AC-000010<GroupDescription></GroupDescription>WN10-AC-000010The number of allowed bad logon attempts must be configured to 3 or less.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000044Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.WN10-AC-000015<GroupDescription></GroupDescription>WN10-AC-000015The period of time before the bad logon counter is reset must be configured to 15 minutes.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0. The smaller this value is, the less effective the account lockout feature will be in protecting the local system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000044CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to "15" minutes.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.WN10-AC-000020<GroupDescription></GroupDescription>WN10-AC-000020The password history must be configured to 24 passwords remembered.<VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000200Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.WN10-AC-000025<GroupDescription></GroupDescription>WN10-AC-000025The maximum password age must be configured to 60 days or less.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000199Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum Password Age" to "60" days or less (excluding "0" which is unacceptable).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding.WN10-AC-000030<GroupDescription></GroupDescription>WN10-AC-000030The minimum password age must be configured to at least 1 day.<VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000198Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum Password Age" to at least "1" day.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for the "Minimum password age" is less than "1" day, this is a finding.WN10-AC-000035<GroupDescription></GroupDescription>WN10-AC-000035Passwords must, at a minimum, be 14 characters.<VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000205Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for the "Minimum password length," is less than "14" characters, this is a finding.WN10-AC-000040<GroupDescription></GroupDescription>WN10-AC-000040The built-in Microsoft password complexity filter must be enabled.<VulnDiscussion>The use of complex passwords increases their strength against guessing and brute-force attacks. This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000192CCI-000193CCI-000194CCI-001619Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. - -If the site is using a password filter that requires this setting be set to "Disabled" for the filter to be used, this would not be considered a finding.WN10-AC-000045<GroupDescription></GroupDescription>WN10-AC-000045Reversible password encryption must be disabled.<VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000196Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding.WN10-AU-000005<GroupDescription></GroupDescription>WN10-AU-000005The system must be configured to audit Account Logon - Credential Validation failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Account Logon >> Credential Validation - FailureWN10-AU-000010<GroupDescription></GroupDescription>WN10-AU-000010The system must be configured to audit Account Logon - Credential Validation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Account Logon >> Credential Validation - SuccessWN10-AU-000030<GroupDescription></GroupDescription>WN10-AU-000030The system must be configured to audit Account Management - Security Group Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security Group Management records events such as creating, deleting or changing of security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Account Management >> Security Group Management - SuccessWN10-AU-000035<GroupDescription></GroupDescription>WN10-AU-000035The system must be configured to audit Account Management - User Account Management failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Account Management >> User Account Management - FailureWN10-AU-000040<GroupDescription></GroupDescription>WN10-AU-000040The system must be configured to audit Account Management - User Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Account Management >> User Account Management - SuccessWN10-AU-000045<GroupDescription></GroupDescription>WN10-AU-000045The system must be configured to audit Detailed Tracking - PNP Activity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Detailed Tracking >> Plug and Play Events - SuccessWN10-AU-000050<GroupDescription></GroupDescription>WN10-AU-000050The system must be configured to audit Detailed Tracking - Process Creation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Process creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Detailed Tracking >> Process Creation - SuccessWN10-AU-000060<GroupDescription></GroupDescription>WN10-AU-000060The system must be configured to audit Logon/Logoff - Group Membership successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Group Membership - SuccessWN10-AU-000065<GroupDescription></GroupDescription>WN10-AU-000065The system must be configured to audit Logon/Logoff - Logoff successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Logoff - SuccessWN10-AU-000070<GroupDescription></GroupDescription>WN10-AU-000070The system must be configured to audit Logon/Logoff - Logon failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Logon - FailureWN10-AU-000075<GroupDescription></GroupDescription>WN10-AU-000075The system must be configured to audit Logon/Logoff - Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Logon - SuccessWN10-AU-000080<GroupDescription></GroupDescription>WN10-AU-000080The system must be configured to audit Logon/Logoff - Special Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Special Logon - SuccessWN10-AU-000085<GroupDescription></GroupDescription>WN10-AU-000085The system must be configured to audit Object Access - Removable Storage failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing object access for removable media records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Object Access >> Removable Storage - Failure - -Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.WN10-AU-000090<GroupDescription></GroupDescription>WN10-AU-000090The system must be configured to audit Object Access - Removable Storage successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing object access for removable media records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Object Access >> Removable Storage - Success - -Some virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.WN10-AU-000100<GroupDescription></GroupDescription>WN10-AU-000100The system must be configured to audit Policy Change - Audit Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Policy Change >> Audit Policy Change - SuccessWN10-AU-000105<GroupDescription></GroupDescription>WN10-AU-000105The system must be configured to audit Policy Change - Authentication Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Authentication Policy Change records events related to changes in authentication policy including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Policy Change >> Authentication Policy Change - SuccessWN10-AU-000110<GroupDescription></GroupDescription>WN10-AU-000110The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Privilege Use >> Sensitive Privilege Use - FailureWN10-AU-000115<GroupDescription></GroupDescription>WN10-AU-000115The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Privilege Use >> Sensitive Privilege Use - SuccessWN10-AU-000120<GroupDescription></GroupDescription>WN10-AU-000120The system must be configured to audit System - IPSec Driver failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -IPSec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPSec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> IPSec Driver - FailureWN10-AU-000130<GroupDescription></GroupDescription>WN10-AU-000130The system must be configured to audit System - Other System Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> Other System Events - SuccessWN10-AU-000135<GroupDescription></GroupDescription>WN10-AU-000135The system must be configured to audit System - Other System Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> Other System Events - FailureWN10-AU-000140<GroupDescription></GroupDescription>WN10-AU-000140The system must be configured to audit System - Security State Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> Security State Change - SuccessWN10-AU-000150<GroupDescription></GroupDescription>WN10-AU-000150The system must be configured to audit System - Security System Extension successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> Security System Extension - SuccessWN10-AU-000155<GroupDescription></GroupDescription>WN10-AU-000155The system must be configured to audit System - System Integrity failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> System Integrity - FailureWN10-AU-000160<GroupDescription></GroupDescription>WN10-AU-000160The system must be configured to audit System - System Integrity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -System >> System Integrity - SuccessWN10-AU-000500<GroupDescription></GroupDescription>WN10-AU-000500The Application event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001849If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. - -Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ - -Value Name: MaxSize - -Value Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)WN10-AU-000505<GroupDescription></GroupDescription>WN10-AU-000505The Security event log size must be configured to 1024000 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "1024000" or greater. - -If the system is configured to send audit records directly to an audit server, documented with the ISSO.If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ - -Value Name: MaxSize - -Value Type: REG_DWORD -Value: 0x000fa000 (1024000) (or greater)WN10-AU-000510<GroupDescription></GroupDescription>WN10-AU-000510The System event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001849If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. - -Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ - -Value Name: MaxSize - -Value Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)WN10-AU-000515<GroupDescription></GroupDescription>WN10-AU-000515Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000162CCI-000163CCI-000164Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. - -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - -NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.WN10-AU-000520<GroupDescription></GroupDescription>WN10-AU-000520Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000162CCI-000163CCI-000164Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. - -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - -NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.WN10-AU-000525<GroupDescription></GroupDescription>WN10-AU-000525Windows 10 permissions for the System event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000162CCI-000163CCI-000164Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. - -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - -NOTE: If "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" has Special Permissions, this would not be a finding.WN10-CC-000005<GroupDescription></GroupDescription>WN10-CC-000005Camera access from the lock screen must be disabled.<VulnDiscussion>Enabling camera access from the lock screen could allow for unauthorized use. Requiring logon will ensure the device is only used by authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381If the device does not have a camera, this is NA. - -Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen camera" to "Enabled".If the device does not have a camera, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ - -Value Name: NoLockScreenCamera - -Value Type: REG_DWORD -Value: 1WN10-CC-000010<GroupDescription></GroupDescription>WN10-CC-000010The display of slide shows on the lock screen must be disabled.<VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen slide show" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ - -Value Name: NoLockScreenSlideshow - -Value Type: REG_DWORD -Value: 1WN10-CC-000020<GroupDescription></GroupDescription>WN10-CC-000020IPv6 source routing must be configured to highest protection.<VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ - -Value Name: DisableIpSourceRouting - -Value Type: REG_DWORD -Value: 2WN10-CC-000025<GroupDescription></GroupDescription>WN10-CC-000025The system must be configured to prevent IP source routing.<VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: DisableIPSourceRouting - -Value Type: REG_DWORD -Value: 2WN10-CC-000030<GroupDescription></GroupDescription>WN10-CC-000030The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.<VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: EnableICMPRedirect - -Value Type: REG_DWORD -Value: 0WN10-CC-000035<GroupDescription></GroupDescription>WN10-CC-000035The system must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002385Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ - -Value Name: NoNameReleaseOnDemand - -Value Type: REG_DWORD -Value: 1WN10-CC-000040<GroupDescription></GroupDescription>WN10-CC-000040Insecure logons to an SMB server must be disabled.<VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders. Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> "Enable insecure guest logons" to "Disabled".Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ - -Value Name: AllowInsecureGuestAuth - -Type: REG_DWORD -Value: 0x00000000 (0)WN10-CC-000050<GroupDescription></GroupDescription>WN10-CC-000050Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.<VulnDiscussion>Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in Hardened UNC paths before allowing access them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> "Hardened UNC Paths" to "Enabled" with at least the following configured in "Hardened UNC Paths:" (click the "Show" button to display). - -Value Name: \\*\SYSVOL -Value: RequireMutualAuthentication=1, RequireIntegrity=1 - -Value Name: \\*\NETLOGON -Value: RequireMutualAuthentication=1, RequireIntegrity=1This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -If the following registry values do not exist or are not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ - -Value Name: \\*\NETLOGON -Value Type: REG_SZ -Value: RequireMutualAuthentication=1, RequireIntegrity=1 - -Value Name: \\*\SYSVOL -Value Type: REG_SZ -Value: RequireMutualAuthentication=1, RequireIntegrity=1 - -Additional entries would not be a finding.WN10-PK-000005<GroupDescription></GroupDescription>WN10-PK-000005The DoD Root CA certificates must be installed in the Trusted Root Store.<VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000185CCI-002470Install the DoD Root CA certificates. -DoD Root CA 2 -DoD Root CA 3 -DoD Root CA 4 -DoD Root CA 5 - -The InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities. - -The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter - -If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 -NotAfter: 12/5/2029 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB -NotAfter: 12/30/2029 - -Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 -NotAfter: 7/25/2032 - -Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -NotAfter: 6/14/2041 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". - -For each of the DoD Root CA certificates noted below: - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -DoD Root CA 2 -Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 -Valid to: Wednesday, December 5, 2029 - -DoD Root CA 3 -Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB -Valid to: Sunday, December 30, 2029 - -DoD Root CA 4 -Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 -Valid to: Sunday, July 25, 2032 - -DoD Root CA 5 -Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -Valid to: Friday, June 14, 2041WN10-CC-000055<GroupDescription></GroupDescription>WN10-CC-000055Simultaneous connections to the Internet or a Windows domain must be limited.<VulnDiscussion>Multiple network connections can provide additional attack vectors to a system and must be limited. The "Minimize the number of simultaneous connections to the Internet or a Windows Domain" setting prevents systems from automatically establishing multiple connections. When both wired and wireless connections are available, for example, the less preferred connection (typically wireless) will be disconnected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366The default behavior for "Minimize the number of simultaneous connections to the Internet or a Windows Domain" is "Enabled". - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> "Minimize the number of simultaneous connections to the Internet or a Windows Domain" to "Enabled".The default behavior for "Minimize the number of simultaneous connections to the Internet or a Windows Domain" is "Enabled". - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "1", this is not a finding. - -If it exists and is configured with a value of "0", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\ - -Value Name: fMinimizeConnections - -Value Type: REG_DWORD -Value: 1 (or if the Value Name does not exist)WN10-PK-000010<GroupDescription></GroupDescription>WN10-PK-000010The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.<VulnDiscussion>To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000185Install the ECA Root CA certificates on unclassified systems. -ECA Root CA 2 -ECA Root CA 4 - -The InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, Thumbprint, NotAfter - -If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US -Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4 -NotAfter: 3/30/2028 - -Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US -Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582 -NotAfter: 12/30/2029 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". - -For each of the ECA Root CA certificates noted below: - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the ECA Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -ECA Root CA 2 -Thumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4 -Valid to: Thursday, March 30, 2028 - -ECA Root CA 4 -Thumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582 -Valid to: Sunday, December 30, 2029WN10-CC-000060<GroupDescription></GroupDescription>WN10-CC-000060Connections to non-domain networks when connected to a domain authenticated network must be blocked.<VulnDiscussion>Multiple network connections can provide additional attack vectors to a system and should be limited. When connected to a domain, communication must go through the domain connection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> "Prohibit connection to non-domain networks when connected to domain authenticated network" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy\ - -Value Name: fBlockNonDomain - -Value Type: REG_DWORD -Value: 1WN10-PK-000015<GroupDescription></GroupDescription>WN10-PK-000015The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000185CCI-002470Install the DoD Interoperability Root CA cross-certificates on unclassified systems. - -Issued To - Issued By - Thumbprint -DoD Root CA 2 - DoD Interoperability Root CA 1 - A8C27332CCB4CA49554CE55D34062A7DD2850C02 -DoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341 - -The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is found, this is a finding. - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -NotAfter: 1/22/2022 - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02 -NotAfter: 8/26/2022 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -Issued To: DoD Root CA 2 -Issued By: DoD Interoperability Root CA 1 -Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02 -Valid to: Friday, August 26, 2022 - -Issued To: DoD Root CA 3 -Issued By: DoD Interoperability Root CA 2 -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -Valid to: Saturday, January 22, 2022WN10-PK-000020<GroupDescription></GroupDescription>WN10-PK-000020The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000185CCI-002470Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. - -Issued To - Issued By - Thumbprint -DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9 - -The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is found, this is a finding. - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US -Thumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9 -NotAfter: 8/26/2022 9:07:50 AM - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": - -Right-click on the certificate and select "Open". - -Select the "Details" tab. - -Scroll to the bottom and select "Thumbprint". - -If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US -Thumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9 -NotAfter: 8/26/2022 9:07:50 AMWN10-CC-000065<GroupDescription></GroupDescription>WN10-CC-000065Wi-Fi Sense must be disabled.<VulnDiscussion>Wi-Fi Sense automatically connects the system to known hotspots and networks that contacts have shared. It also allows the sharing of the system's known networks to contacts. Automatically connecting to hotspots and shared networks can expose a system to unsecured or potentially malicious systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> WLAN Service >> WLAN Settings>> "Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services" to "Disabled". - -v1507 LTSB does not include this group policy setting. It may be configured through other means such as using group policy from a later version of Windows 10 or a registry update.This is NA as of v1803 of Windows 10; Wi-Fi sense is no longer available. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\ - -Value Name: AutoConnectAllowedOEM - -Type: REG_DWORD -Value: 0x00000000 (0)WN10-RG-000005<GroupDescription></GroupDescription>WN10-RG-000005Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive. - -The default permissions of the higher level keys are noted below. - -HKEY_LOCAL_MACHINE\SECURITY -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -SYSTEM - Full Control - This key and subkeys -Administrators - Special - This key and subkeys - -HKEY_LOCAL_MACHINE\SOFTWARE -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys - -HKEY_LOCAL_MACHINE\SYSTEM -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys - -Microsoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID. - -S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive. - -If any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding. - -Run "Regedit". -Right click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. - -HKEY_LOCAL_MACHINE\SECURITY -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -SYSTEM - Full Control - This key and subkeys -Administrators - Special - This key and subkeys - -HKEY_LOCAL_MACHINE\SOFTWARE -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys - -HKEY_LOCAL_MACHINE\SYSTEM -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys - -Other subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. - -Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding. - -S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 - -If the defaults have not been changed, these are not a finding.WN10-CC-000070<GroupDescription></GroupDescription>WN10-CC-000070Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.<VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features, Credential Guard and Virtualization based protection of code integrity. Secure Boot is the minimum security level with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. - -For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Secure Boot" or "Secure Boot and DMA Protection" selected for "Select Platform Security Level:". - -A Microsoft article on Credential Guard system requirement can be found at the following link. -https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirementsConfirm Virtualization Based Security is enabled and running with Secure Boot or Secure Boot and DMA Protection. - -For those devices that support virtualization based security (VBS) features, including Credential Guard or protection of code integrity, this must be enabled. If the system meets the hardware and firmware dependencies for enabling VBS but it is not enabled, this is a CAT III finding. - -Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. - -For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Run "PowerShell" with elevated privileges (run as administrator). - -Enter the following: - -"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" - -If "RequiredSecurityProperties" does not include a value of "2" indicating "Secure Boot" (e.g., "{1, 2}"), this is a finding. - -If "Secure Boot and DMA Protection" is configured, "3" will also be displayed in the results (e.g., "{1, 2, 3}"). - -If "VirtualizationBasedSecurityStatus" is not a value of "2" indicating "Running", this is a finding. - -Alternately: - -Run "System Information". - -Under "System Summary", verify the following: - -If "Device Guard Virtualization based security" does not display "Running", this is finding. - -If "Device Guard Required Security Properties" does not display "Base Virtualization Support, Secure Boot", this is finding. - -If "Secure Boot and DMA Protection" is configured, "DMA Protection" will also be displayed (e.g., "Base Virtualization Support, Secure Boot, DMA Protection"). - -The policy settings referenced in the Fix section will configure the following registry values. However due to hardware requirements, the registry values alone do not ensure proper function. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ - -Value Name: EnableVirtualizationBasedSecurity -Value Type: REG_DWORD -Value: 1 - -Value Name: RequirePlatformSecurityFeatures -Value Type: REG_DWORD -Value: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection) - -A Microsoft article on Credential Guard system requirement can be found at the following link: - -https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements - -NOTE: The severity level for the requirement will be upgraded to CAT II starting January 2020.WN10-CC-000037<GroupDescription></GroupDescription>WN10-CC-000037Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.<VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. - -With User Account Control enabled, filtering the privileged token for built-in administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Apply UAC restrictions to local accounts on network logons" to "Enabled". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the system is not a member of a domain, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LocalAccountTokenFilterPolicy - -Value Type: REG_DWORD -Value: 0x00000000 (0)WN10-CC-000075<GroupDescription></GroupDescription>WN10-CC-000075Credential Guard must be running on Windows 10 domain-joined systems.<VulnDiscussion>Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. - -For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -For VDIs with persistent desktops, this may be downgraded to a CAT II only where administrators have specific tokens for the VDI. Administrator accounts on virtual desktops must only be used on systems in the VDI; they may not have administrative privileges on any other systems such as servers and physical workstations. - -Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration:". - -v1507 LTSB does not include selection options; select "Enable Credential Guard". - -A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: - -https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guardConfirm Credential Guard is running on domain-joined systems. - -For those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled. - -Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. - -For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Run "PowerShell" with elevated privileges (run as administrator). -Enter the following: -"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" - -If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. - -Alternately: - -Run "System Information". -Under "System Summary", verify the following: -If "Device Guard Security Services Running" does not list "Credential Guard", this is finding. - -The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ - -Value Name: LsaCfgFlags -Value Type: REG_DWORD -Value: 0x00000001 (1) (Enabled with UEFI lock) - -WN10-SO-000005<GroupDescription></GroupDescription>WN10-SO-000005The built-in administrator account must be disabled.<VulnDiscussion>The built-in administrator account is a well-known account subject to attack. It also provides no accountability to individual administrators on a system. It must be disabled to prevent its use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000764Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Administrator account status" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Administrator account status" is not set to "Disabled", this is a finding.WN10-CC-000085<GroupDescription></GroupDescription>WN10-CC-000085Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.<VulnDiscussion>By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce "Good, unknown and bad but critical" (preventing "bad"). - -If this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Enabled” with "Good, unknown and bad but critical" selected.The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad"). - -If the registry value name below does not exist, this a finding. - -If it exists and is configured with a value of "7", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ - -Value Name: DriverLoadPolicy - -Value Type: REG_DWORD -Value: 1, 3, or 8 - -Possible values for this setting are: -8 - Good only -1 - Good and unknown -3 - Good, unknown and bad but critical -7 - All (which includes "Bad" and would be a finding) -WN10-CC-000090<GroupDescription></GroupDescription>WN10-CC-000090Group Policy objects must be reprocessed even if they have not changed.<VulnDiscussion>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} - -Value Name: NoGPOListChanges - -Value Type: REG_DWORD -Value: 0WN10-SO-000010<GroupDescription></GroupDescription>WN10-SO-000010The built-in guest account must be disabled.<VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000804Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Guest account status" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding.WN10-CC-000100<GroupDescription></GroupDescription>WN10-CC-000100Downloading print driver packages over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off downloading of print drivers over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DisableWebPnPDownload - -Value Type: REG_DWORD -Value: 1WN10-SO-000015<GroupDescription></GroupDescription>WN10-SO-000015Local accounts with blank passwords must be restricted to prevent access from the network.<VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: LimitBlankPasswordUse - -Value Type: REG_DWORD -Value: 1WN10-SO-000020<GroupDescription></GroupDescription>WN10-SO-000020The built-in administrator account must be renamed.<VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename administrator account" to a name other than "Administrator".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Rename administrator account" is set to "Administrator", this is a finding.WN10-CC-000105<GroupDescription></GroupDescription>WN10-CC-000105Web publishing and online ordering wizards must be prevented from downloading a list of providers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents Windows from downloading a list of providers for the Web publishing and online ordering wizards.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off Internet download for Web publishing and online ordering wizards" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: NoWebServices - -Value Type: REG_DWORD -Value: 1WN10-CC-000110<GroupDescription></GroupDescription>WN10-CC-000110Printing over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off printing over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DisableHTTPPrinting - -Value Type: REG_DWORD -Value: 1WN10-SO-000025<GroupDescription></GroupDescription>WN10-SO-000025The built-in guest account must be renamed.<VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename guest account" to a name other than "Guest".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Rename guest account" is set to "Guest", this is a finding.WN10-CC-000115<GroupDescription></GroupDescription>WN10-CC-000115Systems must at least attempt device authentication using certificates.<VulnDiscussion>Using certificates to authenticate devices to the domain provides increased security over passwords. By default systems will attempt to authenticate using certificates and fall back to passwords if the domain controller does not support certificates for devices. This may also be configured to always use certificates for device authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -The default behavior for "Support device authentication using certificate" is "Automatic". - -If this needs to be corrected, configured the policy value for Computer Configuration >> Administrative Templates >> System >> Kerberos >> "Support device authentication using certificate" to "Not Configured or "Enabled" with either option selected in "Device authentication behavior using certificate:".This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -The default behavior for "Support device authentication using certificate" is "Automatic". - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "1", this is not a finding. - -If it exists and is configured with a value of "0", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ - -Value Name: DevicePKInitEnabled -Value Type: REG_DWORD -Value: 1 (or if the Value Name does not exist)WN10-CC-000120<GroupDescription></GroupDescription>WN10-CC-000120The network selection user interface (UI) must not be displayed on the logon screen.<VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Do not display network selection UI" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: DontDisplayNetworkSelectionUI - -Value Type: REG_DWORD -Value: 1WN10-CC-000130<GroupDescription></GroupDescription>WN10-CC-000130Local users on domain-joined computers must not be enumerated.<VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Enumerate local users on domain-joined computers" to "Disabled".This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnumerateLocalUsers - -Value Type: REG_DWORD -Value: 0WN10-SO-000030<GroupDescription></GroupDescription>WN10-SO-000030Audit policy using subcategories must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000169Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: SCENoApplyLegacyAuditPolicy - -Value Type: REG_DWORD -Value: 1WN10-SO-000035<GroupDescription></GroupDescription>WN10-SO-000035Outgoing secure channel traffic must be encrypted or signed.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RequireSignOrSeal - -Value Type: REG_DWORD -Value: 1WN10-SO-000040<GroupDescription></GroupDescription>WN10-SO-000040Outgoing secure channel traffic must be encrypted when possible.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: SealSecureChannel - -Value Type: REG_DWORD -Value: 1WN10-CC-000145<GroupDescription></GroupDescription>WN10-CC-000145Users must be prompted for a password on resume from sleep (on battery).<VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (on battery)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ - -Value Name: DCSettingIndex - -Value Type: REG_DWORD -Value: 1WN10-SO-000045<GroupDescription></GroupDescription>WN10-SO-000045Outgoing secure channel traffic must be signed when possible.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: SignSecureChannel - -Value Type: REG_DWORD -Value: 1WN10-CC-000150<GroupDescription></GroupDescription>WN10-CC-000150The user must be prompted for a password on resume from sleep (plugged in).<VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (plugged in)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ - -Value Name: ACSettingIndex - -Value Type: REG_DWORD -Value: 1WN10-CC-000155<GroupDescription></GroupDescription>WN10-CC-000155Solicited Remote Assistance must not be allowed.<VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001090Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> "Configure Solicited Remote Assistance" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fAllowToGetHelp - -Value Type: REG_DWORD -Value: 0WN10-SO-000050<GroupDescription></GroupDescription>WN10-SO-000050The computer account password must not be prevented from being reset.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Disable machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: DisablePasswordChange - -Value Type: REG_DWORD -Value: 0WN10-CC-000165<GroupDescription></GroupDescription>WN10-CC-000165Unauthenticated RPC clients must be restricted from connecting to the RPC server.<VulnDiscussion>Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001967Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> "Restrict Unauthenticated RPC clients" to "Enabled" and "Authenticated".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ - -Value Name: RestrictRemoteClients - -Value Type: REG_DWORD -Value: 1WN10-CC-000170<GroupDescription></GroupDescription>WN10-CC-000170The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.<VulnDiscussion>Control of credentials and the system must be maintained within the enterprise. Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Runtime >> "Allow Microsoft accounts to be optional" to "Enabled".Windows 10 LTSC\B versions do not support the Microsoft Store and modern apps; this is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: MSAOptional - -Value Type: REG_DWORD -Value: 0x00000001 (1)WN10-SO-000055<GroupDescription></GroupDescription>WN10-SO-000055The maximum age for machine account passwords must be configured to 30 days or less.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366This is the default configuration for this setting (30 days). - -Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Maximum machine account password age" to "30" or less (excluding 0 which is unacceptable).This is the default configuration for this setting (30 days). - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: MaximumPasswordAge - -Value Type: REG_DWORD -Value: 0x0000001e (30) (or less, excluding 0)WN10-CC-000175<GroupDescription></GroupDescription>WN10-CC-000175The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> "Turn off Inventory Collector" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ - -Value Name: DisableInventory - -Value Type: REG_DWORD -Value: 1WN10-SO-000060<GroupDescription></GroupDescription>WN10-SO-000060The system must be configured to require a strong session key.<VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RequireStrongKey - -Value Type: REG_DWORD -Value: 1 - -Warning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.WN10-CC-000180<GroupDescription></GroupDescription>WN10-CC-000180Autoplay must be turned off for non-volume devices.<VulnDiscussion>Allowing autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoAutoplayfornonVolume - -Value Type: REG_DWORD -Value: 1WN10-SO-000070<GroupDescription></GroupDescription>WN10-SO-000070The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000057Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: InactivityTimeoutSecs - -Value Type: REG_DWORD -Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled)WN10-CC-000185<GroupDescription></GroupDescription>WN10-CC-000185The default autorun behavior must be configured to prevent autorun commands.<VulnDiscussion>Allowing autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents autorun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled:Do not execute any autorun commands".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: NoAutorun - -Value Type: REG_DWORD -Value: 1WN10-CC-000190<GroupDescription></GroupDescription>WN10-CC-000190Autoplay must be disabled for all drives.<VulnDiscussion>Allowing autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs or music on audio media may start. By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. If you enable this policy, you can also disable autoplay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled:All Drives".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ - -Value Name: NoDriveTypeAutoRun - -Value Type: REG_DWORD -Value: 0x000000ff (255) - -Note: If the value for NoDriveTypeAutorun is entered manually, it must be entered as "ff" when Hexadecimal is selected, or "255" with Decimal selected. Using the policy value specified in the Fix section will enter it correctly.WN10-SO-000075<GroupDescription></GroupDescription>WN10-SO-000075The required legal notice must be configured to display before console logon.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000048CCI-000050CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Message text for users attempting to log on" to the following. - -You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LegalNoticeText - -Value Type: REG_SZ -Value: -You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.WN10-CC-000195<GroupDescription></GroupDescription>WN10-CC-000195Enhanced anti-spoofing for facial recognition must be enabled on Window 10.<VulnDiscussion>Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> "Configure enhanced anti-spoofing" to "Enabled". - -v1607: -The policy name is "Use enhanced anti-spoofing when available".Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures\ - -Value Name: EnhancedAntiSpoofing - -Value Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000200<GroupDescription></GroupDescription>WN10-CC-000200Administrator accounts must not be enumerated during elevation.<VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ - -Value Name: EnumerateAdministrators - -Value Type: REG_DWORD -Value: 0WN10-SO-000080<GroupDescription></GroupDescription>WN10-SO-000080The Windows dialog box title for the legal banner must be configured.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. - -If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LegalNoticeCaption - -Value Type: REG_SZ -Value: See message title above - -"DoD Notice and Consent Banner", "US Department of Defense Warning Statement" or a site-defined equivalent, this is a finding. - -If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.WN10-CC-000205<GroupDescription></GroupDescription>WN10-CC-000205Windows Telemetry must not be configured to Full.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services. "Enhanced" includes additional information on how Windows and apps are used and advanced reliability data. Windows Analytics can use a "limited enhanced" level to provide information such as health data for devices. This requires the configuration of an additional setting available with v1709 and later of Windows 10. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> "Allow Telemetry" to "Enabled" with "0 - Security [Enterprise Only]" or "1 - Basic" selected in "Options:". - -If an organization is using v1709 or later of Windows 10 this may be configured to "2 - Enhanced" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ - -Value Name: AllowTelemetry - -Type: REG_DWORD -Value: 0x00000000 (0) (Security) -0x00000001 (1) (Basic) - -If an organization is using v1709 or later of Windows 10 this may be configured to "Enhanced" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics. This registry value will then be 0x00000002 (2).WN10-CC-000210<GroupDescription></GroupDescription>WN10-CC-000210The Windows Defender SmartScreen for Explorer must be enabled.<VulnDiscussion>Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows Defender SmartScreen" to "Enabled" with "Warn and prevent bypass" selected. - -Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer. - -v1607 LTSB: -Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled". (Selection options are not available.) - -v1507 LTSB: -Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with "Require approval from an administrator before running downloaded unknown software" selected.This is applicable to unclassified systems, for other systems this is NA. - -If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnableSmartScreen - -Value Type: REG_DWORD -Value: 0x00000001 (1) - -And - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: ShellSmartScreenLevel - -Value Type: REG_SZ -Value: Block - -v1607 LTSB: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnableSmartScreen - -Value Type: REG_DWORD -Value: 0x00000001 (1) - -v1507 LTSB: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnableSmartScreen - -Value Type: REG_DWORD -Value: 0x00000002 (2)WN10-SO-000085<GroupDescription></GroupDescription>WN10-SO-000085Caching of logon credentials must be limited.<VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366This is the default configuration for this setting (10 logons to cache). - -Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Number of previous logons to cache (in case domain controller is not available)" to "10" logons or less. - -This setting only applies to domain-joined systems, however, it is configured by default on all systems.This is the default configuration for this setting (10 logons to cache). - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: CachedLogonsCount - -Value Type: REG_SZ -Value: 10 (or less) - -This setting only applies to domain-joined systems, however, it is configured by default on all systems.WN10-CC-000215<GroupDescription></GroupDescription>WN10-CC-000215Explorer Data Execution Prevention must be enabled.<VulnDiscussion>Data Execution Prevention (DEP) provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002824The default behavior is for data execution prevention to be turned on for file explorer. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off Data Execution Prevention for Explorer" to "Not Configured" or "Disabled".The default behavior is for data execution prevention to be turned on for file explorer. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoDataExecutionPrevention - -Value Type: REG_DWORD -Value: 0 (or if the Value Name does not exist)WN10-CC-000220<GroupDescription></GroupDescription>WN10-CC-000220Turning off File Explorer heap termination on corruption must be disabled.<VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002385The default behavior is for File Explorer heap termination on corruption to be enabled. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off heap termination on corruption" to "Not Configured" or "Disabled".The default behavior is for File Explorer heap termination on corruption to be enabled. - -If the registry Value Name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoHeapTerminationOnCorruption - -Value Type: REG_DWORD -Value: 0x00000000 (0) (or if the Value Name does not exist)WN10-CC-000225<GroupDescription></GroupDescription>WN10-CC-000225File Explorer shell protocol must run in protected mode.<VulnDiscussion>The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open, to a limited set of folders, increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366The default behavior is for shell protected mode to be turned on for file explorer. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off shell protocol protected mode" to "Not Configured" or "Disabled".The default behavior is for shell protected mode to be turned on for file explorer. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: PreXPSP2ShellProtocolBehavior - -Value Type: REG_DWORD -Value: 0 (or if the Value Name does not exist)WN10-SO-000095<GroupDescription></GroupDescription>WN10-SO-000095The Smart Card removal option must be configured to Force Logoff or Lock Workstation.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: SCRemoveOption - -Value Type: REG_SZ -Value: 1 (Lock Workstation) or 2 (Force Logoff) - -This can be left not configured or set to "No action" on workstations with the following conditions. This must be documented with the ISSO. --The setting cannot be configured due to mission needs, or because it interferes with applications. --Policy must be in place that users manually lock workstations when leaving them unattended. --The screen saver is properly configured to lock as required.WN10-CC-000230<GroupDescription></GroupDescription>WN10-CC-000230Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.<VulnDiscussion>The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads. If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still access malicious websites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Prevent bypassing Windows Defender SmartScreen prompts for sites" to "Enabled". - -Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.This is applicable to unclassified systems, for other systems this is NA. - -Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter\ - -Value Name: PreventOverride - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000235<GroupDescription></GroupDescription>WN10-CC-000235Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.<VulnDiscussion>The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads. If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still download potentially malicious files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Prevent bypassing Windows Defender SmartScreen prompts for files" to "Enabled". - -Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.This is applicable to unclassified systems, for other systems this is NA. - -Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter\ - -Value Name: PreventOverrideAppRepUnknown - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-SO-000100<GroupDescription></GroupDescription>WN10-SO-000100The Windows SMB client must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: RequireSecuritySignature - -Value Type: REG_DWORD -Value: 1WN10-CC-000245<GroupDescription></GroupDescription>WN10-CC-000245The password manager function in the Edge browser must be disabled.<VulnDiscussion>Passwords save locally for re-use when browsing may be subject to compromise. Disabling the Edge password manager will prevent this for the browser.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Configure Password Manager" to "Disabled".Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main\ - -Value Name: FormSuggest Passwords - -Type: REG_SZ -Value: noWN10-SO-000110<GroupDescription></GroupDescription>WN10-SO-000110Unencrypted passwords must not be sent to third-party SMB Servers.<VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000197Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Send unencrypted password to third-party SMB servers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: EnablePlainTextPassword - -Value Type: REG_DWORD -Value: 0WN10-CC-000250<GroupDescription></GroupDescription>WN10-CC-000250The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.<VulnDiscussion>The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Configure Windows Defender SmartScreen" to "Enabled". - -Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.This is applicable to unclassified systems, for other systems this is NA. - -Windows 10 LTSC\B versions do not include Microsoft Edge, this is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter\ - -Value Name: EnabledV9 - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000255<GroupDescription></GroupDescription>WN10-CC-000255The use of a hardware security device with Windows Hello for Business must be enabled.<VulnDiscussion>The use of a Trusted Platform Module (TPM) to store keys for Windows Hello for Business provides additional security. Keys stored in the TPM may only be used on that system while keys stored using software are more susceptible to compromise and could be used on other systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> "Use a hardware security device" to "Enabled". - -v1507 LTSB: -The policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work.Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\ - -Value Name: RequireSecurityDevice - -Type: REG_DWORD -Value: 1WN10-SO-000120<GroupDescription></GroupDescription>WN10-SO-000120The Windows SMB server must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: RequireSecuritySignature - -Value Type: REG_DWORD -Value: 1WN10-CC-000260<GroupDescription></GroupDescription>WN10-CC-000260Windows 10 must be configured to require a minimum pin length of six characters or greater.<VulnDiscussion>Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised. Longer minimum PIN lengths increase the available combinations an attacker would have to attempt. Shorter minimum length significantly reduces the strength.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> "Minimum PIN length" to "6" or greater. - -v1607 LTSB: -The policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> Pin Complexity. - -v1507 LTSB: -The policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work >> Pin Complexity.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity\ - -Value Name: MinimumPINLength - -Type: REG_DWORD -Value: 6 (or greater)WN10-CC-000270<GroupDescription></GroupDescription>WN10-CC-000270Passwords must not be saved in the Remote Desktop Client.<VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> "Do not allow passwords to be saved" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: DisablePasswordSaving - -Value Type: REG_DWORD -Value: 1WN10-CC-000275<GroupDescription></GroupDescription>WN10-CC-000275Local drives must be prevented from sharing with Remote Desktop Session Hosts.<VulnDiscussion>Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001090Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> "Do not allow drive redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fDisableCdm - -Value Type: REG_DWORD -Value: 1WN10-CC-000280<GroupDescription></GroupDescription>WN10-CC-000280Remote Desktop Services must always prompt a client for passwords upon connection.<VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Always prompt for password upon connection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fPromptForPassword - -Value Type: REG_DWORD -Value: 1WN10-CC-000285<GroupDescription></GroupDescription>WN10-CC-000285The Remote Desktop Session Host must require secure RPC communications.<VulnDiscussion>Allowing unsecure RPC communication exposes the system to man in the middle attacks and data disclosure attacks. A man in the middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001453Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security "Require secure RPC communication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fEncryptRPCTraffic - -Value Type: REG_DWORD -Value: 1WN10-SO-000140<GroupDescription></GroupDescription>WN10-SO-000140Anonymous SID/Name translation must not be allowed.<VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.WN10-CC-000290<GroupDescription></GroupDescription>WN10-CC-000290Remote Desktop Services must be configured with the client connection encryption set to the required level.<VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000068CCI-002890Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Set client connection encryption level" to "Enabled" and "High Level".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: MinEncryptionLevel - -Value Type: REG_DWORD -Value: 3WN10-CC-000295<GroupDescription></GroupDescription>WN10-CC-000295Attachments must be prevented from being downloaded from RSS feeds.<VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Prevent downloading of enclosures" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ - -Value Name: DisableEnclosureDownload - -Value Type: REG_DWORD -Value: 1WN10-SO-000145<GroupDescription></GroupDescription>WN10-SO-000145Anonymous enumeration of SAM accounts must not be allowed.<VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictAnonymousSAM - -Value Type: REG_DWORD -Value: 1WN10-CC-000300<GroupDescription></GroupDescription>WN10-CC-000300Basic authentication for RSS feeds over HTTP must not be used.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Turn on Basic feed authentication over HTTP" to "Not Configured" or "Disabled".The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ - -Value Name: AllowBasicAuthInClear - -Value Type: REG_DWORD -Value: 0 (or if the Value Name does not exist)WN10-SO-000150<GroupDescription></GroupDescription>WN10-SO-000150Anonymous enumeration of shares must be restricted.<VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001090Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictAnonymous - -Value Type: REG_DWORD -Value: 1WN10-CC-000305<GroupDescription></GroupDescription>WN10-CC-000305Indexing of encrypted files must be turned off.<VulnDiscussion>Indexing of encrypted files may expose sensitive data. This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> "Allow indexing of encrypted files" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ - -Value Name: AllowIndexingEncryptedStoresOrItems - -Value Type: REG_DWORD -Value: 0WN10-SO-000160<GroupDescription></GroupDescription>WN10-SO-000160The system must be configured to prevent anonymous users from having the same rights as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Let Everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: EveryoneIncludesAnonymous - -Value Type: REG_DWORD -Value: 0WN10-SO-000165<GroupDescription></GroupDescription>WN10-SO-000165Anonymous access to Named Pipes and Shares must be restricted.<VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001090Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: RestrictNullSessAccess - -Value Type: REG_DWORD -Value: 1WN10-SO-000180<GroupDescription></GroupDescription>WN10-SO-000180NTLM must be prevented from falling back to a Null session.<VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ - -Value Name: allownullsessionfallback - -Value Type: REG_DWORD -Value: 0WN10-SO-000185<GroupDescription></GroupDescription>WN10-SO-000185PKU2U authentication using online identities must be prevented.<VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ - -Value Name: AllowOnlineID - -Value Type: REG_DWORD -Value: 0WN10-SO-000190<GroupDescription></GroupDescription>WN10-SO-000190Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.<VulnDiscussion>Certain encryption types are no longer considered secure. This setting configures a minimum encryption type for Kerberos, preventing the use of the DES and RC4 encryption suites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000803Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: - -AES128_HMAC_SHA1 -AES256_HMAC_SHA1 -Future encryption typesIf the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ - -Value Name: SupportedEncryptionTypes - -Value Type: REG_DWORD -Value: 0x7ffffff8 (2147483640)WN10-SO-000195<GroupDescription></GroupDescription>WN10-SO-000195The system must be configured to prevent the storage of the LAN Manager hash of passwords.<VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000196Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: NoLMHash - -Value Type: REG_DWORD -Value: 1WN10-SO-000205<GroupDescription></GroupDescription>WN10-SO-000205The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.<VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to stand-alone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: LmCompatibilityLevel - -Value Type: REG_DWORD -Value: 5WN10-SO-000210<GroupDescription></GroupDescription>WN10-SO-000210The system must be configured to the required LDAP client signing level.<VulnDiscussion>This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ - -Value Name: LDAPClientIntegrity - -Value Type: REG_DWORD -Value: 1WN10-SO-000215<GroupDescription></GroupDescription>WN10-SO-000215The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ - -Value Name: NTLMMinClientSec - -Value Type: REG_DWORD -Value: 0x20080000 (537395200)WN10-SO-000220<GroupDescription></GroupDescription>WN10-SO-000220The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ - -Value Name: NTLMMinServerSec - -Value Type: REG_DWORD -Value: 0x20080000 (537395200)WN10-SO-000230<GroupDescription></GroupDescription>WN10-SO-000230The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.<VulnDiscussion>This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002450Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ - -Value Name: Enabled - -Value Type: REG_DWORD -Value: 1 - -Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.WN10-SO-000240<GroupDescription></GroupDescription>WN10-SO-000240The default permissions of global system objects must be increased.<VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ - -Value Name: ProtectionMode - -Value Type: REG_DWORD -Value: 1WN10-SO-000245<GroupDescription></GroupDescription>WN10-SO-000245User Account Control approval mode for the built-in Administrator must be enabled.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: FilterAdministratorToken - -Value Type: REG_DWORD -Value: 1WN10-SO-000250<GroupDescription></GroupDescription>WN10-SO-000250User Account Control must, at minimum, prompt administrators for consent on the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ConsentPromptBehaviorAdmin - -Value Type: REG_DWORD -Value: 2 (Prompt for consent on the secure desktop)WN10-SO-000255<GroupDescription></GroupDescription>WN10-SO-000255User Account Control must automatically deny elevation requests for standard users.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges. This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ConsentPromptBehaviorUser - -Value Type: REG_DWORD -Value: 0WN10-SO-000260<GroupDescription></GroupDescription>WN10-SO-000260User Account Control must be configured to detect application installations and prompt for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableInstallerDetection - -Value Type: REG_DWORD -Value: 1WN10-SO-000265<GroupDescription></GroupDescription>WN10-SO-000265User Account Control must only elevate UIAccess applications that are installed in secure locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableSecureUIAPaths - -Value Type: REG_DWORD -Value: 1WN10-SO-000270<GroupDescription></GroupDescription>WN10-SO-000270User Account Control must run all administrators in Admin Approval Mode, enabling UAC.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableLUA - -Value Type: REG_DWORD -Value: 1WN10-SO-000275<GroupDescription></GroupDescription>WN10-SO-000275User Account Control must virtualize file and registry write failures to per-user locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableVirtualization - -Value Type: REG_DWORD -Value: 1WN10-UC-000015<GroupDescription></GroupDescription>WN10-UC-000015Toast notifications to the lock screen must be turned off.<VulnDiscussion>Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> "Turn off toast notifications on the lock screen" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\ - -Value Name: NoToastApplicationNotificationOnLockScreen - -Value Type: REG_DWORD -Value: 1WN10-UC-000020<GroupDescription></GroupDescription>WN10-UC-000020Zone information must be preserved when saving attachments.<VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366The default behavior is for Windows to mark file attachments with their zone information. - -If this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled".The default behavior is for Windows to mark file attachments with their zone information. - -If the registry Value Name below does not exist, this is not a finding. - -If it exists and is configured with a value of "2", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ - -Value Name: SaveZoneInformation - -Value Type: REG_DWORD -Value: 0x00000002 (2) (or if the Value Name does not exist)WN10-UR-000005<GroupDescription></GroupDescription>WN10-UR-000005The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts are granted the "Access Credential Manager as a trusted caller" user right, this is a finding.WN10-UR-000010<GroupDescription></GroupDescription>WN10-UR-000010The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Access this computer from the network" user right may access resources on the system, and must be limited to those that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to only include the following groups or accounts: - -Administrators -Remote Desktop UsersVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Access this computer from the network" user right, this is a finding: - -Administrators -Remote Desktop Users - -If a domain application account such as for a management tool requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account, managed at the domain level, must meet requirements for application account passwords, such as length and frequency of changes as defined in the Windows server STIGs.WN10-UR-000015<GroupDescription></GroupDescription>WN10-UR-000015The Act as part of the operating system user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding.WN10-UR-000025<GroupDescription></GroupDescription>WN10-UR-000025The Allow log on locally user right must only be assigned to the Administrators and Users groups.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to only include the following groups or accounts: - -Administrators -UsersVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Allow log on locally" user right, this is a finding: - -Administrators -UsersWN10-UR-000030<GroupDescription></GroupDescription>WN10-UR-000030The Back up files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data."</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Back up files and directories" user right, this is a finding: - -AdministratorsWN10-UR-000035<GroupDescription></GroupDescription>WN10-UR-000035The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\autotimesvc.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Change the system time" user right can change the system time, which can impact authentication, as well as affect time stamps on event log entries. - -The NT SERVICE\autotimesvc is added in v1909 cumulative update. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Change the system time" to only include the following groups or accounts: - -Administrators -LOCAL SERVICE -NT SERVICE\autotimesvc is added in v1909 cumulative update.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Change the system time" user right, this is a finding: - -Administrators -LOCAL SERVICE -NT SERVICE\autotimesvc is added in v1909 cumulative update.WN10-UR-000040<GroupDescription></GroupDescription>WN10-UR-000040The Create a pagefile user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Create a pagefile" user right, this is a finding: - -AdministratorsWN10-UR-000045<GroupDescription></GroupDescription>WN10-UR-000045The Create a token object user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts are granted the "Create a token object" user right, this is a finding.WN10-UR-000050<GroupDescription></GroupDescription>WN10-UR-000050The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to only include the following groups or accounts: - -Administrators -LOCAL SERVICE -NETWORK SERVICE -SERVICEVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Create global objects" user right, this is a finding: - -Administrators -LOCAL SERVICE -NETWORK SERVICE -SERVICEWN10-UR-000055<GroupDescription></GroupDescription>WN10-UR-000055The Create permanent shared objects user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts are granted the "Create permanent shared objects" user right, this is a finding.WN10-UR-000060<GroupDescription></GroupDescription>WN10-UR-000060The Create symbolic links user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Create symbolic links" user right, this is a finding: - -Administrators - -If the workstation has an approved use of Hyper-V, such as being used as a dedicated admin workstation using Hyper-V to separate administration and standard user functions, "NT VIRTUAL MACHINES\VIRTUAL MACHINE" may be assigned this user right and is not a finding.WN10-UR-000065<GroupDescription></GroupDescription>WN10-UR-000065The Debug programs user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Debug Programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Debug Programs" user right, this is a finding: - -AdministratorsWN10-UR-000070<GroupDescription></GroupDescription>WN10-UR-000070The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny access to this computer from the network" right defines the accounts that are prevented from logging on from the network. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following. - -Domain Systems Only: -Enterprise Admins group -Domain Admins group -Local account (see Note below) - -All Systems: -Guests group - -Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.) - -Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following groups or accounts are not defined for the "Deny access to this computer from the network" right, this is a finding: - -Domain Systems Only: -Enterprise Admins group -Domain Admins group -Local account (see Note below) - -All Systems: -Guests group - -Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.) - -Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.WN10-UR-000075<GroupDescription></GroupDescription>WN10-UR-000075The Deny log on as a batch job user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Deny log on as a batch job" right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following. - -Domain Systems Only: -Enterprise Admin Group -Domain Admin GroupThis requirement is applicable to domain-joined systems, for standalone systems this is NA. - -Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following groups or accounts are not defined for the "Deny log on as a batch job" right, this is a finding: - -Domain Systems Only: -Enterprise Admin Group -Domain Admin GroupWN10-UR-000080<GroupDescription></GroupDescription>WN10-UR-000080The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Deny log on as a service" right defines accounts that are denied log on as a service. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. - -Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213This requirement is applicable to domain-joined systems, for standalone systems this is NA. - -Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include the following. - -Domain Systems Only: -Enterprise Admins Group -Domain Admins GroupThis requirement is applicable to domain-joined systems, for standalone systems this is NA. - -Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following groups or accounts are not defined for the "Deny log on as a service" right , this is a finding: - -Domain Systems Only: -Enterprise Admins Group -Domain Admins GroupWN10-UR-000085<GroupDescription></GroupDescription>WN10-UR-000085The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on locally" right defines accounts that are prevented from logging on interactively. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following. - -Domain Systems Only: -Enterprise Admins Group -Domain Admins Group - -Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.) - -All Systems: -Guests GroupVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following groups or accounts are not defined for the "Deny log on locally" right, this is a finding. - -Domain Systems Only: -Enterprise Admins Group -Domain Admins Group - -Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.) - -All Systems: -Guests GroupWN10-UR-000090<GroupDescription></GroupDescription>WN10-UR-000090The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on through Remote Desktop Services" right defines the accounts that are prevented from logging on using Remote Desktop Services. - -If Remote Desktop Services is not used by the organization, the Everyone group must be assigned this right to prevent all access. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000213CCI-002314Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following. - -If Remote Desktop Services is not used by the organization, assign the Everyone group this right to prevent all access. - -Domain Systems Only: -Enterprise Admins group -Domain Admins group -Local account (see Note below) - -All Systems: -Guests group - -Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.) - -Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following groups or accounts are not defined for the "Deny log on through Remote Desktop Services" right, this is a finding: - -If Remote Desktop Services is not used by the organization, the "Everyone" group can replace all of the groups listed below. - -Domain Systems Only: -Enterprise Admins group -Domain Admins group -Local account (see Note below) - -All Systems: -Guests group - -Privileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.) - -Note: "Local account" is a built-in security group used to assign user rights and permissions to all local accounts.WN10-UR-000095<GroupDescription></GroupDescription>WN10-UR-000095The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding.WN10-UR-000100<GroupDescription></GroupDescription>WN10-UR-000100The Force shutdown from a remote system user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system which could result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: - -AdministratorsWN10-UR-000110<GroupDescription></GroupDescription>WN10-UR-000110The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to only include the following groups or accounts: - -Administrators -LOCAL SERVICE -NETWORK SERVICE -SERVICEVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: - -Administrators -LOCAL SERVICE -NETWORK SERVICE -SERVICEWN10-UR-000120<GroupDescription></GroupDescription>WN10-UR-000120The Load and unload device drivers user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Load and unload device drivers" user right, this is a finding: - -AdministratorsWN10-UR-000125<GroupDescription></GroupDescription>WN10-UR-000125The Lock pages in memory user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts are granted the "Lock pages in memory" user right, this is a finding.WN10-UR-000130<GroupDescription></GroupDescription>WN10-UR-000130The Manage auditing and security log user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000162CCI-000163CCI-000164CCI-000171CCI-001914Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Manage auditing and security log" user right, this is a finding: - -Administrators - -If the organization has an "Auditors" group the assignment of this group to the user right would not be a finding.WN10-UR-000140<GroupDescription></GroupDescription>WN10-UR-000140The Modify firmware environment values user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Modify firmware environment values" user right, this is a finding: - -AdministratorsWN10-UR-000145<GroupDescription></GroupDescription>WN10-UR-000145The Perform volume maintenance tasks user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in, data loss or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: - -AdministratorsWN10-UR-000150<GroupDescription></GroupDescription>WN10-UR-000150The Profile single process user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could potentially use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Profile single process" user right, this is a finding: - -AdministratorsWN10-UR-000160<GroupDescription></GroupDescription>WN10-UR-000160The Restore files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to over-write more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Restore files and directories" user right, this is a finding: - -AdministratorsWN10-UR-000165<GroupDescription></GroupDescription>WN10-UR-000165The Take ownership of files or other objects user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. - -Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to only include the following groups or accounts: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any groups or accounts other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: - -AdministratorsWN10-CC-000206<GroupDescription></GroupDescription>WN10-CC-000206Windows Update must not obtain updates from other PCs on the Internet.<VulnDiscussion>Windows 10 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> "Download Mode" to "Enabled" with any option except "Internet" selected. - -Acceptable selections include: -Bypass (100) -Group (2) -HTTP only (0) -LAN (1) -Simple (99) - -v1507 (LTSB) does not include this group policy setting locally. For domain joined systems, configure through domain group policy as "HTTP only (0)" or "Lan (1)". Standalone systems configure using Settings >> Update & Security >> Windows Update >> Advanced Options >> "Choose how updates are delivered" with either "Off" or "PCs on my local network" selected.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ - -Value Name: DODownloadMode - -Value Type: REG_DWORD -Value: 0x00000000 (0) - No peering (HTTP Only) -0x00000001 (1) - Peers on same NAT only (LAN) -0x00000002 (2) - Local Network / Private group peering (Group) -0x00000063 (99) - Simple download mode, no peering (Simple) -0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) - -A value of 0x00000003 (3), Internet, is a finding. - -v1507 LTSB: -Domain joined systems: -Verify the registry value above. -If the value is not 0x00000000 (0) or 0x00000001 (1), this is a finding. - -Standalone systems (configured in Settings): -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\ - -Value Name: DODownloadMode - -Value Type: REG_DWORD -Value: 0x00000000 (0) - Off -0x00000001 (1) - LANWN10-CC-000066<GroupDescription></GroupDescription>WN10-CC-000066Command line data must be included in process creation events.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ - -Value Name: ProcessCreationIncludeCmdLine_Enabled - -Value Type: REG_DWORD -Value: 1WN10-CC-000326<GroupDescription></GroupDescription>WN10-CC-000326PowerShell script block logging must be enabled on Windows 10.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ - -Value Name: EnableScriptBlockLogging - -Value Type: REG_DWORD -Value: 1WN10-00-000145<GroupDescription></GroupDescription>WN10-00-000145Data Execution Prevention (DEP) must be configured to at least OptOut.<VulnDiscussion>Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002824Configure DEP to at least OptOut. - -Note: Suspend BitLocker before making changes to the DEP configuration. - -Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator). -Enter "BCDEDIT /set {current} nx OptOut". (If using PowerShell "{current}" must be enclosed in quotes.) -"AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP. - -Opted out exceptions can be configured in the "System Properties". - -Open "System" in Control Panel. -Select "Advanced system settings". -Click "Settings" in the "Performance" section. -Select the "Data Execution Prevention" tab. -Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:".Verify the DEP configuration. -Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator). -Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.) -If the value for "nx" is not "OptOut", this is a finding. -(The more restrictive configuration of "AlwaysOn" would not be a finding.)WN10-00-000150<GroupDescription></GroupDescription>WN10-00-000150Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.<VulnDiscussion>Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handling overwrite technique, a common buffer overflow attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002824Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Enable Structured Exception Handling Overwrite Protection (SEHOP)" to "Enabled". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This is applicable to Windows 10 prior to v1709. - -Verify SEHOP is turned on. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\kernel\ - -Value Name: DisableExceptionChainValidation - -Value Type: REG_DWORD -Value: 0x00000000 (0)WN10-00-000155<GroupDescription></GroupDescription>WN10-00-000155The Windows PowerShell 2.0 feature must be disabled on the system.<VulnDiscussion>Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Disable "Windows PowerShell 2.0" on the system. - -Run "Windows PowerShell" with elevated privileges (run as administrator). -Enter the following: -Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root - -This command should disable both "MicrosoftWindowsPowerShellV2Root" and "MicrosoftWindowsPowerShellV2" which correspond to "Windows PowerShell 2.0" and "Windows PowerShell 2.0 Engine" respectively in "Turn Windows features on or off". - -Alternately: -Search for "Features". -Select "Turn Windows features on or off". -De-select "Windows PowerShell 2.0".Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter the following: -Get-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2* - -If either of the following have a "State" of "Enabled", this is a finding. - -FeatureName : MicrosoftWindowsPowerShellV2 -State : Enabled -FeatureName : MicrosoftWindowsPowerShellV2Root -State : Enabled - -Alternately: -Search for "Features". - -Select "Turn Windows features on or off". - -If "Windows PowerShell 2.0" (whether the subcategory of "Windows PowerShell 2.0 Engine" is selected or not) is selected, this is a finding.WN10-00-000160<GroupDescription></GroupDescription>WN10-00-000160The Server Message Block (SMB) v1 protocol must be disabled on the system.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. - -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older Network Attached Storage (NAS) devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Disable the SMBv1 protocol. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter the following: -Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol - -Alternately: -Search for "Features". - -Select "Turn Windows features on or off". - -De-select "SMB 1.0/CIFS File Sharing Support".Different methods are available to disable SMBv1 on Windows 10. This is the preferred method, however if V-74723 and V-74725 are configured, this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter the following: -Get-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol - -If "State : Enabled" is returned, this is a finding. - -Alternately: -Search for "Features". - -Select "Turn Windows features on or off". - -If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding.WN10-AU-000054<GroupDescription></GroupDescription>WN10-AU-000054The system must be configured to audit Logon/Logoff - Account Lockout failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open a Command Prompt with elevated privileges ("Run as Administrator"). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Account Lockout - FailureWN10-AU-000107<GroupDescription></GroupDescription>WN10-AU-000107The system must be configured to audit Policy Change - Authorization Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Policy Change >> Authorization Policy Change - SuccessWN10-CC-000038<GroupDescription></GroupDescription>WN10-CC-000038WDigest Authentication must be disabled.<VulnDiscussion>When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. WDigest is disabled by default in Windows 10. This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled". - -The patch referenced in the policy title is not required for Windows 10. - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ - -Value Name: UseLogonCredential - -Type: REG_DWORD -Value: 0x00000000 (0)WN10-CC-000044<GroupDescription></GroupDescription>WN10-CC-000044Internet connection sharing must be disabled.<VulnDiscussion>Internet connection sharing makes it possible for an existing internet connection, such as through wireless, to be shared and used by other systems essentially creating a mobile hotspot. This exposes the system sharing the connection to others with potentially malicious purpose.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Connections >> "Prohibit use of Internet Connection Sharing on your DNS domain network" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Network Connections\ - -Value Name: NC_ShowSharedAccessUI - -Type: REG_DWORD -Value: 0x00000000 (0)WN10-SO-000167<GroupDescription></GroupDescription>WN10-SO-000167Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.<VulnDiscussion>The Windows Security Account Manager (SAM) stores users' passwords. Restricting remote rpc connections to the SAM to Administrators helps protect those credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002235Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict clients allowed to make remote calls to SAM". - -Select "Edit Security" to configure the "Security descriptor:". - -Add "Administrators" in "Group or user names:" if it is not already listed (this is the default). - -Select "Administrators" in "Group or user names:". - -Select "Allow" for "Remote Access" in "Permissions for "Administrators". - -Click "OK". - -The "Security descriptor:" must be populated with "O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.Windows 10 v1507 LTSB version does not include this setting, it is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictRemoteSAM - -Value Type: REG_SZ -Value: O:BAG:BAD:(A;;RC;;;BA)WN10-CC-000197<GroupDescription></GroupDescription>WN10-CC-000197Microsoft consumer experiences must be turned off.<VulnDiscussion>Microsoft consumer experiences provides suggestions and notifications to users, which may include the installation of Windows Store apps. Organizations may control the execution of applications through other means such as whitelisting. Turning off Microsoft consumer experiences will help prevent the unwanted installation of suggested applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> "Turn off Microsoft consumer experiences" to "Enabled".Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\ - -Value Name: DisableWindowsConsumerFeatures - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000039<GroupDescription></GroupDescription>WN10-CC-000039Run as different user must be removed from context menus.<VulnDiscussion>The "Run as different user" selection from context menus allows the use of credentials other than the currently logged on user. Using privileged credentials in a standard user session can expose those credentials to theft. Removing this option from context menus helps prevent this from occurring.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Remove "Run as Different User" from context menus" to "Enabled". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry values do not exist or are not configured as specified, this is a finding. -The policy configures the same Value Name, Type and Value under four different registry paths. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Paths: -\SOFTWARE\Classes\batfile\shell\runasuser\ -\SOFTWARE\Classes\cmdfile\shell\runasuser\ -\SOFTWARE\Classes\exefile\shell\runasuser\ -\SOFTWARE\Classes\mscfile\shell\runasuser\ - -Value Name: SuppressionPolicy - -Type: REG_DWORD -Value: 0x00001000 (4096)WN10-00-000210<GroupDescription></GroupDescription>WN10-00-000210Bluetooth must be turned off unless approved by the organization.<VulnDiscussion>If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Turn off Bluetooth radios not organizationally approved. Establish an organizational policy for the use of Bluetooth.This is NA if the system does not have Bluetooth. - -Verify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding. - -Approval must be documented with the ISSO.WN10-00-000220<GroupDescription></GroupDescription>WN10-00-000220Bluetooth must be turned off when not in use.<VulnDiscussion>If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.This is NA if the system does not have Bluetooth. - -Verify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.WN10-00-000230<GroupDescription></GroupDescription>WN10-00-000230The system must notify the user when a Bluetooth device attempts to connect.<VulnDiscussion>If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure Bluetooth to notify users if devices attempt to connect. -View Bluetooth Settings. -Ensure "Alert me when a new Bluetooth device wants to connect" is checked.This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy. - -Search for "Bluetooth". -View Bluetooth Settings. -Select "More Bluetooth Options" -If "Alert me when a new Bluetooth device wants to connect" is not checked, this is a finding.WN10-AU-000084<GroupDescription></GroupDescription>WN10-AU-000084Windows 10 must be configured to audit Object Access - Other Object Access Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following: - -Object Access >> Other Object Access Events - Failure - -If the system does not audit the above, this is a finding.WN10-AU-000083<GroupDescription></GroupDescription>WN10-AU-000083Windows 10 must be configured to audit Object Access - Other Object Access Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following: - -Object Access >> Other Object Access Events - Success - -If the system does not audit the above, this is a finding.WN10-CC-000052<GroupDescription></GroupDescription>WN10-CC-000052Windows 10 must be configured to prioritize ECC Curves with longer key lengths first.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first. Requiring ECC curves with longer key lengths to be prioritized first helps ensure more secure algorithms are used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000803Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> SSL Configuration Settings >> "ECC Curve Order" to "Enabled" with "ECC Curve Order:" including the following in the order listed: - -NistP384 -NistP256If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\ - -Value Name: EccCurves - -Value Type: REG_MULTI_SZ -Value: NistP384 NistP256WN10-CC-000252<GroupDescription></GroupDescription>WN10-CC-000252Windows 10 must be configured to disable Windows Game Recording and Broadcasting.<VulnDiscussion>Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data. Disabling the feature will prevent this from occurring.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> "Enables or disables Windows Game Recording and Broadcasting" to "Disabled".This is NA for Windows 10 LTSC\B versions 1507 and 1607. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\GameDVR\ - -Value Name: AllowGameDVR - -Type: REG_DWORD -Value: 0x00000000 (0)WN10-CC-000068<GroupDescription></GroupDescription>WN10-CC-000068Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.<VulnDiscussion>An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host. Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials. Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> "Remote host allows delegation of non-exportable credentials" to "Enabled".This is NA for Windows 10 LTSC\B versions 1507 and 1607. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ - -Value Name: AllowProtectedCreds - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-00-000175<GroupDescription></GroupDescription>WN10-00-000175The Secondary Logon service must be disabled on Windows 10.<VulnDiscussion>The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges. Using privileged credentials in a standard user session can expose those credentials to theft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the "Secondary Logon" service "Startup Type" to "Disabled".Run "Services.msc". - -Locate the "Secondary Logon" service. - -If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding.WN10-AU-000082<GroupDescription></GroupDescription>WN10-AU-000082Windows 10 must be configured to audit Object Access - File Share successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing file shares records events related to connection to shares on a system including system shares such as C$.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit File Share" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following: - -Object Access >> File Share - Success - -If the system does not audit the above, this is a finding.WN10-00-000165<GroupDescription></GroupDescription>WN10-00-000165The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. - -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. - -The system must be restarted for the change to take effect.Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ - -Value Name: SMB1 - -Type: REG_DWORD -Value: 0x00000000 (0)WN10-00-000170<GroupDescription></GroupDescription>WN10-00-000170The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. - -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. - -The system must be restarted for the changes to take effect. Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA. - -If the following registry value is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ - -Value Name: Start - -Type: REG_DWORD -Value: 0x00000004 (4)WN10-AU-000081<GroupDescription></GroupDescription>WN10-AU-000081Windows 10 must be configured to audit Object Access - File Share failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing file shares records events related to connection to shares on a system including system shares such as C$.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit File Share" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open PowerShell or a Command Prompt with elevated privileges ("Run as Administrator"). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following: - -Object Access >> File Share - Failure - -If the system does not audit the above, this is a finding.WN10-00-000190<GroupDescription></GroupDescription>WN10-00-000190Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10.<VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.Review the effective User Rights setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) - -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.WN10-00-000015<GroupDescription></GroupDescription>WN10-00-000015Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.<VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Verify the system firmware is configured to run in UEFI mode, not Legacy BIOS. - -Run "System Information". - -Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding.WN10-00-000020<GroupDescription></GroupDescription>WN10-00-000020Secure Boot must be enabled on Windows 10 systems.<VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Enable Secure Boot in the system firmware.Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. - -For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. - -Run "System Information". - -Under "System Summary", if "Secure Boot State" does not display "On", this is finding.WN10-EP-000020<GroupDescription></GroupDescription>WN10-EP-000020Windows 10 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on.<VulnDiscussion>Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level. Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure Exploit Protection system-level mitigation, "Data Execution Prevention (DEP)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. - -Open "Windows Defender Security Center". - -Select "App & browser control". - -Select "Exploit protection settings". - -Under "System settings", configure "Data Execution Prevention (DEP)" to "On by default" or "Use default (<On>)". - -The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under <SystemConfig>): - -<SystemConfig> - <DEP Enable="true"></DEP> -</SystemConfig> - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -System". - -If the status of "DEP: Enable" is "OFF", this is a finding. - -Values that would not be a finding include: -ON -NOTSET (Default configuration)WN10-EP-000030<GroupDescription></GroupDescription>WN10-EP-000030Windows 10 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on.<VulnDiscussion>Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level. Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-002824Ensure Exploit Protection system-level mitigation, "Randomize memory allocations (Bottom-Up ASLR)" is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. - -Open "Windows Defender Security Center". - -Select "App & browser control". - -Select "Exploit protection settings". - -Under "System settings", configure "Randomize memory allocations (Bottom-Up ASLR)" to "On by default" or "Use default (<On>)". - -The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under <SystemConfig>): - -<SystemConfig> - <ASLR BottomUp="true"</ASLR> -</SystemConfig> - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -System". - -If the status of "ASLR: BottomUp" is "OFF", this is a finding. - -Values that would not be a finding include: -ON -NOTSET (Default configuration)WN10-EP-000040<GroupDescription></GroupDescription>WN10-EP-000040Windows 10 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on.<VulnDiscussion>Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level. Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure Exploit Protection system-level mitigation, "Control flow guard (CFG)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. - -Open "Windows Defender Security Center". - -Select "App & browser control". - -Select "Exploit protection settings". - -Under "System settings", configure "Control flow guard (CFG)" to "On by default" or "Use default (<On>)". - -The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under <SystemConfig>): - -<SystemConfig> - <ControlFlowGuard Enable="true"></ControlFlowGuard> -</SystemConfig> - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -System". - -If the status of "CFG: Enable" is "OFF", this is a finding. - -Values that would not be a finding include: -ON -NOTSET (Default configuration)WN10-EP-000050<GroupDescription></GroupDescription>WN10-EP-000050Windows 10 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on.<VulnDiscussion>Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure Exploit Protection system-level mitigation, "Validate exception chains (SEHOP)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. - -Open "Windows Defender Security Center". - -Select "App & browser control". - -Select "Exploit protection settings". - -Under "System settings", configure "Validate exception chains (SEHOP)" to "On by default" or "Use default (<On>)". - -The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under <SystemConfig>): - -<SystemConfig> - <SEHOP Enable="true"></SEHOP> -</SystemConfig> - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -System". - -If the status of "SEHOP: Enable" is "OFF", this is a finding. - -Values that would not be a finding include: -ON -NOTSET (Default configuration)WN10-EP-000060<GroupDescription></GroupDescription>WN10-EP-000060Windows 10 Exploit Protection system-level mitigation, Validate heap integrity, must be on.<VulnDiscussion>Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure Exploit Protection system-level mitigation, "Validate heap integrity" is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. - -Open "Windows Defender Security Center". - -Select "App & browser control". - -Select "Exploit protection settings". - -Under "System settings", configure "Validate heap integrity" to "On by default" or "Use default (<On>)". - -The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under <SystemConfig>): - -<SystemConfig> - <Heap TerminateOnError="true"></Heap> -</SystemConfig> - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -System". - -If the status of "Heap: TerminateOnError" is "OFF", this is a finding. - -Values that would not be a finding include: -ON -NOTSET (Default configuration)WN10-EP-000070 <GroupDescription></GroupDescription>WN10-EP-000070Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for Acrobat.exe: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name Acrobat.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000080<GroupDescription></GroupDescription>WN10-EP-000080Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for AcroRd32.exe: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot= False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name AcroRd32.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot= False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000090<GroupDescription></GroupDescription>WN10-EP-000090Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown forchrome.exe: - -DEP: -OverrideDEP: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name chrome.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -OverrideDEP: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000100<GroupDescription></GroupDescription>WN10-EP-000100Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for EXCEL.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name EXCEL.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000110<GroupDescription></GroupDescription>WN10-EP-000110Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown firefox.exe: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: On - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name firefox.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: On - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000120<GroupDescription></GroupDescription>WN10-EP-000120Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for FLTLDR.EXE: - -DEP: -Override DEP: False - -ImageLoad: -OverrideBlockRemoteImages: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Child Process: -OverrideChildProcess: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name FLTLDR.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ImageLoad: -OverrideBlockRemoteImages: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Child Process: -OverrideChildProcess: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000130<GroupDescription></GroupDescription>WN10-EP-000130Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown GROOVE.EXE: - -DEP: -OverrideDEP: False - -ASLR: -OverrideBlockRemoteImages: False - -ImageLoad: -ForceRelocateImages: True - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Child Process: -OverrideChildProcess: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name GROOVE.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -OverrideDEP: False - -ASLR: -ForceRelocateImages: On - -ImageLoad: -OverrideBlockRemoteImages: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Child Process: -OverrideChildProcess: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000140<GroupDescription></GroupDescription>WN10-EP-000140Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for iexplore.exe: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name iexplore.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000150<GroupDescription></GroupDescription>WN10-EP-000150Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for INFOPATH.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name INFOPATH.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000160<GroupDescription></GroupDescription>WN10-EP-000160Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured for java.exe, javaw.exe, and javaws.exe: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: -java.exe, javaw.exe, and javaws.exe -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000170<GroupDescription></GroupDescription>WN10-EP-000170Exploit Protection mitigations in Windows 10 must be configured for lync.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for lync.exe: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name lync.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000180<GroupDescription></GroupDescription>WN10-EP-000180Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for MSACCESS.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name MSACCESS.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000190<GroupDescription></GroupDescription>WN10-EP-000190Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for MSPUB.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name MSPUB.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000210<GroupDescription></GroupDescription>WN10-EP-000210Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured for OneDrive.exe: - -DEP: -Override DEP: False - -ASLR: -OverrideRelocateImages: NOTSET - -ImageLoad: -OverrideBlockRemoteImages: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name OneDrive.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -OverrideRelocateImages: NOTSET - -ImageLoad: -OverrideBlockRemoteImages: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000200<GroupDescription></GroupDescription>WN10-EP-000200Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for OIS.EXE: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name OIS.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -OverrideDEP: False - -Payload: -OverrideEnableExportAddressFilter: False -OverrideEnableExportAddressFilterPlus: False -OverrideEnableImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000220<GroupDescription></GroupDescription>WN10-EP-000220Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for OUTLOOK.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name OUTLOOK.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000230<GroupDescription></GroupDescription>WN10-EP-000230Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown forplugin-container.exe: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name plugin-container.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status shown below, this is a finding: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000240<GroupDescription></GroupDescription>WN10-EP-000240Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for POWERPNT.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name POWERPNT.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000250<GroupDescription></GroupDescription>WN10-EP-000250Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for PPTVIEW.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name PPTVIEW.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000260<GroupDescription></GroupDescription>WN10-EP-000260Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for VISIO.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name VISIO.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000270<GroupDescription></GroupDescription>WN10-EP-000270Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for VPREVIEW.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name VPREVIEW.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000280<GroupDescription></GroupDescription>WN10-EP-000280Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for WINWORD.EXE: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name WINWORD.EXE". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -ASLR: -ForceRelocateImages: ON - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000290<GroupDescription></GroupDescription>WN10-EP-000290Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for wmplayer.exe: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name wmplayer.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-EP-000300<GroupDescription></GroupDescription>WN10-EP-000300Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.<VulnDiscussion>Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following mitigations are configured as shown for wordpad.exe: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -Application mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the "Supporting Files" folder. - -The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is NA prior to v1709 of Windows 10. - -This is applicable to unclassified systems, for other systems this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-ProcessMitigation -Name wordpad.exe". -(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) - -If the following mitigations do not have the listed status which is shown below, this is a finding: - -DEP: -Override DEP: False - -Payload: -OverrideExportAddressFilter: False -OverrideExportAddressFilterPlus: False -OverrideImportAddressFilter: False -OverrideEnableRopStackPivot: False -OverrideEnableRopCallerCheck: False -OverrideEnableRopSimExec: False - -The PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.WN10-00-000240<GroupDescription></GroupDescription>WN10-00-000240Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.<VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. - -Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email. - -The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Implement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. - -The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. - -If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.WN10-UC-000005<GroupDescription></GroupDescription>WN10-UC-000005The use of personal accounts for OneDrive synchronization must be disabled.<VulnDiscussion>OneDrive provides access to external services for data storage, which must be restricted to authorized instances. Enabling this setting will prevent the use of personal OneDrive accounts for synchronization.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for User Configuration >> Administrative Templates >> OneDrive >> "Prevent users from synchronizing personal OneDrive accounts" to "Enabled". - -Group policy files for OneDrive are located on a system with OneDrive in "%localappdata%\Microsoft\OneDrive\BuildNumber\adm\". - -Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Policies\Microsoft\OneDrive\ - -Value Name: DisablePersonalSync - -Value Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000238<GroupDescription></GroupDescription>WN10-CC-000238Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.<VulnDiscussion>Web security certificates provide an indication whether a site is legitimate. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> "Prevent certificate error overrides" to "Enabled".This setting is applicable starting with v1809 of Windows 10; it is NA for prior versions. - -Windows 10 LTSC\B versions do not include Microsoft Edge; this is NA for those systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\MicrosoftEdge\Internet Settings\ - -Value Name: PreventCertErrorOverrides - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000204<GroupDescription></GroupDescription>WN10-CC-000204If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Enhanced" level for telemetry includes additional information beyond "Security" and "Basic" on how Windows and apps are used and advanced reliability data. Windows Analytics can use a "limited enhanced" level to provide information such as health data for devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> "Limit Enhanced diagnostic data to the minimum required by Windows Analytics" to "Enabled" with "Enable Windows Analytics collection" selected in "Options:".This setting requires v1709 or later of Windows 10; it is NA for prior versions. - -If "Enhanced" level is enabled for telemetry, this must be configured. If "Security" or "Basic" are configured, this is NA. (See V-63683). - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ - -Value Name: LimitEnhancedDiagnosticDataWindowsAnalytics - -Type: REG_DWORD -Value: 0x00000001 (1)WN10-CC-000340<GroupDescription></GroupDescription>WN10-CC-000340OneDrive must only allow synchronizing of accounts for DoD organization instances.<VulnDiscussion>OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> "Allow syncing OneDrive accounts for only specific organizations", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444. - -If the organization does not have an instance of OneDrive, configure the Tenant GUID with "1111-2222-3333-4444". - -Group policy files for OneDrive are located on a system with OneDrive in "%localappdata%\Microsoft\OneDrive\BuildNumber\adm\". - -Copy the OneDrive.admx and .adml files to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance. - -If the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\OneDrive\AllowTenantList\ - -Value Name: Organization's Tenant GUID - -Value Type: REG_SZ -Value: Organization's Tenant GUID - -If the organization does not have an instance of OneDrive the Value Name and Value must be 1111-2222-3333-4444, if not this is a finding.WN10-CC-000365<GroupDescription></GroupDescription>WN10-CC-000365Windows 10 must be configured to prevent Windows apps from being activated by voice while the system is locked.<VulnDiscussion>Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are only used by authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000056Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice while the system is locked" to "Enabled" with “Default for all Apps:” set to “Force Deny”. - -The requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> "Let Windows apps activate with voice" is configured to "Enabled" with “Default for all Apps:” set to “Force Deny”.This setting requires v1903 or later of Windows 10; it is NA for prior versions. The setting is NA when the “Allow voice activation” policy is configured to disallow applications to be activated with voice for all users. -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\ - -Value Name: LetAppsActivateWithVoiceAboveLock - -Type: REG_DWORD -Value: 0x00000002 (2) - -If the following registry value exists and is configured as specified, requirement is NA. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\ - -Value Name: LetAppsActivateWithVoice - -Type: REG_DWORD -Value: 0x00000002 (2)WN10-00-000031<GroupDescription></GroupDescription>WN10-00-000031Windows 10 systems must use a BitLocker PIN for pre-boot authentication.<VulnDiscussion>If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001199CCI-002475CCI-002476Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives "Require additional authentication at startup" to "Enabled" with "Configure TPM Startup PIN:" set to "Require startup PIN with TPM" or with "Configure TPM startup key and PIN:" set to "Require startup key and PIN with TPM".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\FVE\ - -Value Name: UseAdvancedStartup -Type: REG_DWORD -Value: 0x00000001 (1) - -If one of the following registry values does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\FVE\ - -Value Name: UseTPMPIN -Type: REG_DWORD -Value: 0x00000001 (1) - -Value Name: UseTPMKeyPIN -Type: REG_DWORD -Value: 0x00000001 (1) - - -BitLocker network unlock may be used in conjunction with a BitLocker PIN. See the article below regarding information about network unlock. - -https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlockWN10-00-000032<GroupDescription></GroupDescription>WN10-00-000032Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.<VulnDiscussion>If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001199CCI-002475CCI-002476Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives "Configure minimum PIN length for startup" to "Enabled" with "Minimum characters:" set to "6" or greater.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\FVE\ - -Value Name: MinimumPIN -Type: REG_DWORD -Value: 0x00000006 (6) or greaterWN10-AU-000565<GroupDescription></GroupDescription>WN10-AU-000565Windows 10 must be configured to audit other Logon/Logoff Events Failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Other Logon/Logoff Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Other Logon/Logoff Events - Failure -WN10-AU-000560<GroupDescription></GroupDescription>WN10-AU-000560Windows 10 must be configured to audit other Logon/Logoff Events Successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Other Logon/Logoff Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Logon/Logoff >> Other Logon/Logoff Events - Success -WN10-AU-000570<GroupDescription></GroupDescription>WN10-AU-000570Windows 10 must be configured to audit Detailed File Share Failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Detailed File Share allows you to audit attempts to access files and folders on a shared folder. -The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> “Detailed File Share" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Object Access >> Detailed File Share - Failure -WN10-AU-000575<GroupDescription></GroupDescription>WN10-AU-000575Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Policy Change >> MPSSVC Rule-Level Policy Change - Success -WN10-AU-000580<GroupDescription></GroupDescription>WN10-AU-000580Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Policy Change >> MPSSVC Rule-Level Policy Change - Failure -WN10-AU-000550<GroupDescription></GroupDescription>WN10-AU-000550Windows 10 must be configured to audit Other Policy Change Events Successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> "Audit Other Policy Change Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Policy Change >> Other Policy Change Events - Success -WN10-AU-000555<GroupDescription></GroupDescription>WN10-AU-000555Windows 10 must be configured to audit Other Policy Change Events Failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> "Audit Other Policy Change Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: - -Policy Change >> Other Policy Change Events - Failure -WN10-SO-000280<GroupDescription></GroupDescription>WN10-SO-000280Passwords for enabled local Administrator accounts must be changed at least every 60 days.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure. - -Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000199Change the enabled local Administrator account password at least every "60" days. - -Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement. -Review the password last set date for the enabled local Administrator account. - -On the local domain joined workstation: - -Open "PowerShell". - -Enter "Get-LocalUser –Name * | Select-Object *” - -If the "PasswordLastSet" date is greater than "60" days old for the local Administrator account for administering the computer/domain, this is a finding. -WN10-EP-000310<GroupDescription></GroupDescription>WN10-EP-000310Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.<VulnDiscussion>Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001090Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Kernel DMA Protection >> "Enumeration policy for external devices incompatible with Kernel DMA Protection" to "Enabled" with "Enumeration Policy" set to "Block All".This is NA prior to v1803 of Windows 10. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Kernel DMA Protection - -Value Name: DeviceEnumerationPolicy -Value Type: REG_DWORD -Value: 0WN10-CC-000370<GroupDescription></GroupDescription>WN10-CC-000370The convenience PIN for Windows 10 must be disabled. <VulnDiscussion>This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Disable the convenience PIN sign-in. - -If this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> Set "Turn on convenience PIN sign-in" to "Disabled”. -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\System - -Value Name: AllowDomainPINLogon -Value Type: REG_DWORD -Value data: 0WN10-CC-000385<GroupDescription></GroupDescription>WN10-CC-000385Windows Ink Workspace configured but disallow access above the lock. <VulnDiscussion>Securing Windows Ink which contains application and features oriented towards pen computing. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Disable the convenience PIN sign-in. - -If this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace >> Set " Allow Windows Ink Workspace" to "Enabled” Set Options ‘On, but disallow access above lock”. -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\WindowsInkWorkspace - -Value Name: AllowWindowsInkWorkspace -Value Type: REG_DWORD -Value data: 1 - -WN10-CC-000390<GroupDescription></GroupDescription>WN10-CC-000390Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications. <VulnDiscussion>Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> "Do not suggest third-party content in Windows spotlight" to "EnabledIf the following registry value does not exist or is not configured as specified, this is a finding. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CloudContent\ - -Value Name: DisableThirdPartySuggestions - -Type: REG_DWORD -Value: 0x00000001 (1) - -SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN10-CC-000007Windows 10 must cover or disable the built-in or attached camera when not in use.<VulnDiscussion>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. - -Failing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures. - -Satisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155 -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000381If the camera is not disconnected or covered, the following registry entry is required. - -Registry Hive: HKEY_LOCAL_MACHINE -RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam - -Value Name: Deny -If the device or operating system does not have a camera installed, this requirement is not applicable. - -This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision. - -This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed. - -For an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding. - -For a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in -camera is not disabled in the bios, this is a finding. - -If the camera is not disconnected or covered, the following registry entry is required: - -Registry Hive: HKEY_LOCAL_MACHINE -RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam - -Value Name: Deny - -If "Value Name" is set to a value other than "Deny" and the collaborative computing device has not been authorized for use, this is a finding. -WN10-00-000250<GroupDescription></GroupDescription>WN10-00-000250Windows 10 non-persistent VM sessions should not exceed 24 hours. <VulnDiscussion>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization should enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-001199Set non-persistent VM sessions to not exceed 24 hours. Ensure there is a documented policy or procedure in place that non-persistent VM sessions do not exceed 24 hours. - -If there is no such documented policy or procedure in place, this is a finding.WN10-CC-000328 <GroupDescription></GroupDescription>WN10-CC-000328 The Windows Explorer Preview pane must be disabled for Windows 10.<VulnDiscussion>A known vulnerability in Windows 10 could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane. - -Organizations must disable the Windows Preview pane and Windows Detail pane.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000366Ensure the following settings are configured for Windows 10 locally or applied through group policy. - -Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn off Preview Pane" to "Enabled". - -Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn on or off details pane" to "Enabled" and "Configure details pane" to "Always hide". -If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - -Value Name: NoPreviewPane - -Value Type: REG_DWORD - -Value: 1 - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - -Value Name: NoReadingPane - -Value Type: REG_DWORD - -Value: 1WN10-SO-000251<GroupDescription></GroupDescription>WN10-SO-000251Windows 10 must use multifactor authentication for local and network access to privileged and non-privileged accounts.<VulnDiscussion>Without the use of multifactor authentication, the ease of access to privileged and non-privileged functions is greatly increased. - -All domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. - -Multifactor authentication requires using two or more factors to achieve authentication. - -Factors include: - -1) Something a user knows (e.g., password/PIN); - -2) Something a user has (e.g., cryptographic identification device, token); and - -3) Something a user is (e.g., biometric). - -A privileged account is defined as an information system account with authorizations of a privileged user. - -Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet). - -Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. - -The DoD CAC with DoD-approved PKI is an example of multifactor authentication. - -Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 10DISADPMS TargetWindows 102885CCI-000765CCI-000766CCI-000767CCI-000768For non-domain joined systems, configuring Windows Hello for sign on options would be suggested based on the organizations needs and capabilities. - -Note: Before applying, the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system. -If the system is a member of a domain this is Not Applicable. - -If one of the following settings does not exist and is not populated, this is a finding: - -Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\Readers -Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards diff --git a/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V2R2_Manual-xccdf.log b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V2R2_Manual-xccdf.log new file mode 100644 index 000000000..c93c4a01f --- /dev/null +++ b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V2R2_Manual-xccdf.log @@ -0,0 +1,18 @@ +V-220745::"Minimum password length,"::"Minimum password length" +V-220747::"Store password using reversible encryption"::"Store passwords using reversible encryption" +V-220836::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System'; ValueData = 'Block'; ValueName = 'ShellSmartScreenLevel'; ValueType = 'String'}HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System'; ValueData = $null; ValueName = 'EnableSmartScreen'; ValueType = 'Dword'; OrganizationValueTestString = "{0} -eq 1|2"} +V-220860::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\::Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +V-220805::Registry Path: \SOFTWARE\Policies\Microsoft\ Cryptography\Configuration\SSL\00010002\::Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002\ +V-220704::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE'; ValueData = $null; ValueName = 'MinimumPIN'; ValueType = 'DWord'; OrganizationValueTestString = 'ValueData is set to 0x00000006 (6) or greater '} +V-220870::Value data: 0::Value: 0x00000000 (0) +V-220871::Value data: 1::Value: 0x00000001 (1) +V-220793::RegistryPath\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam::Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam +V-220793::This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.::ValueType: REG_SZ +V-220793::This requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.::Value: Deny +V-220793::Value Name: Deny::ValueName: Value +V-220961::NT SERVICE\autotimesvc is added in v1909 cumulative update.::NT SERVICE\autotimesvc +V-220891::OverrideExportAddressFilter: False::OverrideEnableExportAddressFilter: False +V-220891::OverrideExportAddressFilterPlus: False::OverrideEnableExportAddressFilterPlus: False +V-220891::OverrideImportAddressFilter: False::OverrideEnableImportAddressFilter: False +V-220922::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'LegalNoticeCaption'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "'{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$'"} +V-220921::assistants. Such communications and work product are private and confidential. See::assistants. Such communications and work product are private and confidential. See diff --git a/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V2R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V2R2_Manual-xccdf.xml new file mode 100644 index 000000000..1381b3983 --- /dev/null +++ b/source/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V2R2_Manual-xccdf.xml @@ -0,0 +1,4560 @@ +acceptedWindows 10 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 04 May 20213.2.2.360791.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>Physical security<GroupDescription></GroupDescription>WN12-00-000001Server systems must be located in a controlled access area, accessible only to authorized personnel.<VulnDiscussion>Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security is the first line of protection of any system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure servers are located in secure, access-controlled areas.Verify servers are located in controlled access areas that are accessible only to authorized personnel. If systems are not adequately protected, this is a finding.Shared User Accounts<GroupDescription></GroupDescription>WN12-00-000012Shared user accounts must not be permitted on the system.<VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000764Remove unapproved shared accounts from the system. - -Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.Determine whether any shared accounts exist. If no shared accounts exist, this is NA. - -Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. - -If unapproved shared accounts exist, this is a finding.Unsupported Service Packs<GroupDescription></GroupDescription>WN12-GE-000001Systems must be maintained at a supported service pack level.<VulnDiscussion>Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Update the system to a supported release or service pack level.Run "winver.exe". - -If the "About Windows" dialog box does not display -"Microsoft Windows Server -Version 6.2 (Build 9200)" -or greater, this is a finding. - -No preview versions will be used in a production environment. - -Unsupported Service Packs/Releases: -Windows 2012 - any release candidates or versions prior to the initial release.WIN00-000100<GroupDescription></GroupDescription>WN12-00-000100The Windows 2012 / 2012 R2 system must use an anti-virus program.<VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install an anti-virus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. - -If there is no anti-virus solution installed on the system, this is a finding.Display Shutdown Button<GroupDescription></GroupDescription>WN12-SO-000073The shutdown option must not be available from the logon dialog box.<VulnDiscussion>Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box ensures that individuals who shut down the system are authorized and tracked in the system's Security event log.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25100-9CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Shutdown: Allow system to be shutdown without having to log on" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ShutdownWithoutLogon - -Value Type: REG_DWORD -Value: 0System Recovery Backups<GroupDescription></GroupDescription>WN12-00-000014System-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. - -System-level information includes system-state information, operating system and application software, and licenses. - -Backups must be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement system-level information backups in accordance with local recovery time and recovery point objectives.Determine whether system-level information is backed up in accordance with local recovery time and recovery point objectives. If system-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.NTFS Requirement<GroupDescription></GroupDescription>WN12-GE-000005Local volumes must use a format that supports NTFS attributes.<VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, local volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Format local volumes to use NTFS or ReFS.Open "Computer Management". - -Select "Disk Management" under "Storage". - -For each local volume, if the file system does not indicate "NTFS", this is a finding. - -"ReFS" (Resilient File System) is also acceptable and would not be a finding. - -“CSV” (Cluster Share Volumes) is also acceptable and would not be a finding. - -This does not apply to system partitions such as the Recovery and EFI System Partition.Legal Notice Display<GroupDescription></GroupDescription>WN12-SO-000022The required legal notice must be configured to display before console logon.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25355-9CCI-000048CCI-000050CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message text for users attempting to log on" to the following: - -You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LegalNoticeText - -Value Type: REG_SZ -Value: See message text below - -You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.Caching of logon credentials<GroupDescription></GroupDescription>WN12-SO-000024Caching of logon credentials must be limited.<VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24264-4CCI-000366If the system is not a member of a domain, this is NA. - -Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.If the system is not a member of a domain, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: CachedLogonsCount - -Value Type: REG_SZ -Value: 4 (or less)Anonymous shares are not restricted<GroupDescription></GroupDescription>WN12-SO-000052Anonymous enumeration of shares must be restricted.<VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24774-2CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictAnonymous - -Value Type: REG_DWORD -Value: 1Bad Logon Attempts<GroupDescription></GroupDescription>WN12-AC-000002The number of allowed bad logon attempts must meet minimum requirements.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23909-5CCI-000044Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy -> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy. - -If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.Bad Logon Counter Reset<GroupDescription></GroupDescription>WN12-AC-000003The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 2012.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24840-1CCI-000044CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.Lockout Duration<GroupDescription></GroupDescription>WN12-AC-000001Windows 2012 account lockout duration must be configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24768-4CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. - -A value of "0" is also acceptable, requiring an administrator to unlock the account.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. - -Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.User Right - Act as part of OS<GroupDescription></GroupDescription>WN12-UR-000003The Act as part of the operating system user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25043-1CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Maximum Password Age <GroupDescription></GroupDescription>WN12-AC-000005The maximum password age must meet requirements.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24535-7CCI-000199Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Maximum password age" to "60" days or less (excluding "0" which is unacceptable).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. - -If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding.Minimum Password Age<GroupDescription></GroupDescription>WN12-AC-000006The minimum password age must meet requirements.<VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24018-4CCI-000198Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Minimum password age" to at least "1" day.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. - -If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately."), this is a finding.Password Uniqueness<GroupDescription></GroupDescription>WN12-AC-000004The password history must be configured to 24 passwords remembered.<VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24644-7CCI-000200Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.Dormant Accounts<GroupDescription></GroupDescription>WN12-GE-000014Outdated or unused accounts must be removed from the system or disabled.<VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000795Regularly review accounts to determine if they are still active. Disable or delete any active accounts that have not been used in the last 35 days.Run "PowerShell". - -Member servers and standalone systems: -Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) - -"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { - $user = ([ADSI]$_.Path) - $lastLogin = $user.Properties.LastLogin.Value - $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 - if ($lastLogin -eq $null) { - $lastLogin = 'Never' - } - Write-Host $user.Name $lastLogin $enabled -}" - -This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). -For example: User1 10/31/2015 5:49:56 AM True - -Domain Controllers: -Enter the following command in PowerShell. -"Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" - -This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. - -Review the list of accounts returned by the above queries to determine the finding validity for each account reported. - -Exclude the following accounts: -Built-in administrator account (Renamed, SID ending in 500) -Built-in guest account (Renamed, Disabled, SID ending in 501) -Application accounts - -If any enabled accounts have not been logged on to within the past 35 days, this is a finding. - -Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.Disable Guest Account<GroupDescription></GroupDescription>WN12-SO-000003The built-in guest account must be disabled.<VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24387-3CCI-000804Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Guest account status" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. - -If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding.Rename Built-in Guest Account<GroupDescription></GroupDescription>WN12-SO-000006The built-in guest account must be renamed.<VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23675-2CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename guest account" to a name other than "Guest".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. - -If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding.Rename Built-in Administrator Account<GroupDescription></GroupDescription>WN12-SO-000005The built-in administrator account must be renamed.<VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23836-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename administrator account" to a name other than "Administrator".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. - -If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.Booting into Multiple Operating Systems<GroupDescription></GroupDescription>WN12-GE-000010The system must not boot into multiple operating systems (dual-boot).<VulnDiscussion>Allowing a system to boot into multiple operating systems (dual-booting) may allow security to be circumvented on a secure system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure Windows Server 2012 is the only operating system installed for the system to boot into. Remove alternate operating systems.Verify the local system boots directly into Windows. - -Open Control Panel. -Select "System". -Select the "Advanced System Settings" link. -Select the "Advanced" tab. -Click the "Startup and Recovery" Settings button. - -If the drop-down list box "Default operating system:" shows any operating system other than Windows Server 2012, this is a finding.Prohibited FTP Logins<GroupDescription></GroupDescription>WN12-GE-000026File Transfer Protocol (FTP) servers must be configured to prevent anonymous logons.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. - -Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Configure the FTP service to prevent anonymous logons.If FTP is not installed on the system, this is NA. - -Determine the IP address and port number assigned to FTP sites from documentation or configuration. - -If Microsoft FTP is used, open "Internet Information Services (IIS) Manager". - -Select "Sites" under the server name. - -For any sites that reference FTP, view the Binding information for IP address and port. The standard port for FTP is 21, however this may be changed. - -Open a "Command Prompt". - -Attempt to log on as the user "anonymous" with the following commands: - -Note: Returned results may vary depending on the FTP server software. - -C:\> "ftp" -ftp> "Open IP Address Port" -(Substituting [IP Address] and [Port] with the information previously identified. If no IP Address was listed in the Binding, attempt using "localhost".) -(Connected to IP Address -220 Microsoft FTP Service) - -User (IP Address): "anonymous" -(331 Anonymous access allowed, send identity (e-mail name) as password.) - -Password: "password" -(230 User logged in.) -ftp> - -If the response indicates that an anonymous FTP login was permitted, this is a finding. - -If accounts with administrator privileges are used to access FTP, this is a CAT I finding.FTP System File Access<GroupDescription></GroupDescription>WN12-GE-000027File Transfer Protocol (FTP) servers must be configured to prevent access to the system drive.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Access outside of the specific directories of shared data could provide access to system resources and compromise the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Configure the system to only allow FTP access to specific folders containing the data to be available through the service.If FTP is not installed on the system, this is NA. - -Determine the IP address and port number assigned to FTP sites from documentation or configuration. - -If Microsoft FTP is used, open "Internet Information Services (IIS) Manager". - -Select "Sites" under the server name. - -For any sites that reference FTP, view the Binding information for IP address and port. The standard port for FTP is 21, however this may be changed. - -Open a "Command Prompt". - -Access the FTP site and review accessible directories with the following commands: - -Note: Returned results may vary depending on the FTP server software. - -C:\> "ftp" -ftp> "Open IP Address Port" -(Substituting [IP Address] and [Port] with the information previously identified. If no IP Address was listed in the Binding, attempt using "localhost".) -(Connected to IP Address -220 Microsoft FTP Service) - -User (IP Address): "FTP User" -(Substituting [FTP User] with an account identified that is allowed access. If it was determined that anonymous access was allowed to the site [see V-1120], also review access using "anonymous".) - (331 Password required) - -Password: "Password" -(Substituting [Password] with password for the account attempting access.) -(230 User ftpuser logged in.) - -ftp> "Dir" - -If the FTP session indicates access to areas of the system other than the specific folder for FTP data, such as the root of the drive, Program Files or Windows directories, this is a finding.Restricted Administrator Group Membership<GroupDescription></GroupDescription>WN12-GE-000004-DCOnly administrators responsible for the domain controller must have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. - -System administrators must log on to systems only using accounts with the minimum level of authority necessary. - -Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Configure the system to include only administrator groups or accounts that are responsible for the system in the Administrators group. - -Remove any standard user accounts.Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. - -Standard user accounts must not be members of the local administrator group. - -If prohibited accounts are members of the local administrators group, this is a finding. - -The built-in Administrator account or other required administrative accounts would not be a finding.Security Configuration Tools<GroupDescription></GroupDescription>WN12-00-000013Security configuration tools or equivalent processes must be used to configure and maintain platforms for security compliance.<VulnDiscussion>Security configuration tools such as Group Policies and Security Templates allow system administrators to consolidate security-related system settings into a single configuration file. These settings can then be applied consistently to any number of Windows machines.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement a process using security configuration tools or the equivalent to configure Windows systems to meet security requirements.Verify security configuration tools or equivalent processes are being used to configure Windows systems to meet security requirements. If security configuration tools or equivalent processes are not used, this is a finding. - -Security configuration tools that are integrated into Windows, such as Group Policies and Security Templates, may be used to configure platforms for security compliance. - -If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable.Printer Share Permissions<GroupDescription></GroupDescription>WN12-GE-000012Nonadministrative user accounts or groups must only have print permissions on printer shares.<VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the permissions on shared printers to restrict standard users to only have Print permissions. This is typically given through the Everyone group by default.Open "Devices and Printers" in Control Panel or through Search. -If there are no printers configured, this is NA.(Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) - -For each configured printer: -Right click on the printer. -Select "Printer Properties". -Select the "Sharing" tab. -View whether "Share this printer" is checked. - -For any printers with "Share this printer" selected: -Select the Security tab. - -If any standard user accounts or groups have permissions other than "Print", this is a finding. -Standard users will typically be given "Print" permission through the Everyone group. -"All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement.Forcibly Disconnect when Logon Hours Expire<GroupDescription></GroupDescription>WN12-SO-000034Users must be forcibly disconnected when their logon hours expire.<VulnDiscussion>Users must not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. Forcibly disconnecting users when logon hours expire protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24148-9CCI-001133Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Disconnect clients when logon hours expire" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: EnableForcedLogoff - -Value Type: REG_DWORD -Value: 1Unencrypted Password is Sent to SMB Server.<GroupDescription></GroupDescription>WN12-SO-000030Unencrypted passwords must not be sent to third-party SMB Servers.<VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24751-0CCI-000197Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: EnablePlainTextPassword - -Value Type: REG_DWORD -Value: 0Disable Automatic Logon<GroupDescription></GroupDescription>WN12-SO-000036Automatic logons must be disabled.<VulnDiscussion>Allowing a system to automatically log on when the machine is booted could give access to any unauthorized individual who restarts the computer. Automatic logon with administrator privileges would give full access to an unauthorized individual.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>If the DefaultName or DefaultDomainName in the same registry path contain an administrator account name and the DefaultPassword contains a value, this is a CAT I finding.</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24927-6CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)" to "Disabled". - -Ensure no passwords are stored in the "DefaultPassword" registry value noted below: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: DefaultPassword - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: AutoAdminLogon - -Type: REG_SZ -Value: 0Microsoft Strong Password Filtering<GroupDescription></GroupDescription>WN12-AC-000008The built-in Windows password complexity policy must be enabled.<VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least 3 of the 4 types of characters (numbers, upper- and lower-case letters, and special characters), as well as preventing the inclusion of user names or parts of.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25602-4CCI-000192CCI-000193CCI-000194CCI-001619Configure the policy value for Computer Configuration >> Windows Settings -> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. - -Note: If an external password filter is in use that enforces all 4 character types and requires this setting be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes.Secure Print Driver Installation<GroupDescription></GroupDescription>WN12-SO-000089The print driver installation privilege must be restricted to administrators.<VulnDiscussion>Allowing users to install drivers can introduce malware or cause the instability of a system. Print driver installation should be restricted to administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25176-9CCI-001812Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Prevent users from installing printer drivers" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\ - -Value Name: AddPrinterDrivers - -Value Type: REG_DWORD -Value: 1Anonymous Access to the Registry<GroupDescription></GroupDescription>WN12-RG-000004Anonymous access to the registry must be restricted.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require anonymous access to the registry. This must be limited to properly protect the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Maintain permissions at least as restrictive as the defaults listed below for the "winreg" registry key. It is recommended to not change the permissions from the defaults. - -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ - -The following are the same for each permission listed: -Type - Allow -Inherited from - None - -Columns: Principal - Access - Applies to -Administrators - Full Control - This key and subkeys -Backup Operators - Read - This key only -LOCAL SERVICE - Read - This key and subkeysRun "Regedit". -Navigate to the following registry key: -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ - -If the key does not exist, this is a finding. - -Right-click on "winreg" and select "Permissions…". -Select "Advanced". - -If the permissions are not as restrictive as the defaults listed below, this is a finding. - -The following are the same for each permission listed: -Type - Allow -Inherited from - None - -Columns: Principal - Access - Applies to -Administrators - Full Control - This key and subkeys -Backup Operators - Read - This key only -LOCAL SERVICE - Read - This key and subkeysLanMan Authentication Level<GroupDescription></GroupDescription>WN12-SO-000067The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.<VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to stand-alone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24650-4CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: LmCompatibilityLevel - -Value Type: REG_DWORD -Value: 5Ctrl+Alt+Del Security Attention Sequence<GroupDescription></GroupDescription>WN12-SO-000019The Ctrl+Alt+Del security attention sequence for logons must be enabled.<VulnDiscussion>Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, a user can be assured that any passwords entered following that sequence are sent only to Windows. If the sequence requirement is eliminated, malicious programs can request and receive a user's Windows password. Disabling this sequence also suppresses a custom logon banner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25803-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Do not require CTRL+ALT+DEL" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: DisableCAD - -Value Type: REG_DWORD -Value: 0Deny Access from the Network<GroupDescription></GroupDescription>WN12-UR-000017-DCThe Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny access to this computer from the network" to include the following: - -Guests GroupVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: - -Guests GroupSmart Card Removal Option <GroupDescription></GroupDescription>WN12-SO-000027The Smart Card removal option must be configured to Force Logoff or Lock Workstation.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24154-7CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: SCRemoveOption - -Value Type: REG_SZ -Value: 1 (Lock Workstation) or 2 (Force Logoff) - -If configuring this on servers causes issues such as terminating users' remote sessions and the site has a policy in place that any other sessions on the servers such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO.SMB Server Packet Signing (if client agrees)<GroupDescription></GroupDescription>WN12-SO-000033The Windows SMB server must perform SMB packet signing when possible.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24354-3CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: EnableSecuritySignature - -Value Type: REG_DWORD -Value: 1Encryption of Secure Channel Traffic<GroupDescription></GroupDescription>WN12-SO-000013Outgoing secure channel traffic must be encrypted when possible.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24414-5CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: SealSecureChannel - -Value Type: REG_DWORD -Value: 1 - -If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831).Signing of Secure Channel Traffic<GroupDescription></GroupDescription>WN12-SO-000014Outgoing secure channel traffic must be signed when possible.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24812-0CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: SignSecureChannel - -Value Type: REG_DWORD -Value: 1 - -If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831).Computer Account Password Reset<GroupDescription></GroupDescription>WN12-SO-000015The computer account password must not be prevented from being reset.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24243-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Disable machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: DisablePasswordChange - -Value Type: REG_DWORD -Value: 0SMB Client Packet Signing (if server agrees)<GroupDescription></GroupDescription>WN12-SO-000029The Windows SMB client must be enabled to perform SMB packet signing when possible.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24740-3CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: EnableSecuritySignature - -Value Type: REG_DWORD -Value: 1Members of the Backup Operators Group<GroupDescription></GroupDescription>WN12-00-000009-01Members of the Backup Operators group must be documented.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Visibility of members of the Backup Operators group must be maintained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Create the necessary documentation that identifies the members of the Backup Operators group.If no accounts are members of the Backup Operators group, this is NA. - -Any accounts that are members of the Backup Operators group, including application accounts, must be documented with the ISSO. If documentation of accounts that are members of the Backup Operators group is not maintained this is a finding.Format and Eject Removable Media<GroupDescription></GroupDescription>WN12-SO-000011Ejection of removable NTFS media must be restricted to Administrators.<VulnDiscussion>Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25217-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Allowed to format and eject removable media" to "Administrators".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: AllocateDASD - -Value Type: REG_SZ -Value: 0Password Expiration Warning<GroupDescription></GroupDescription>WN12-SO-000025Users must be warned in advance of their passwords expiring.<VulnDiscussion>Creating strong passwords that can be remembered by users requires some thought. By giving the user advance warning, the user has time to construct a sufficiently strong password. This setting configures the system to display a warning to users telling them how many days are left before their password expires.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23704-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Prompt user to change password before expiration" to "14" days or more.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: PasswordExpiryWarning - -Value Type: REG_DWORD -Value: 14 (or greater)Global System Objects Permission Strength<GroupDescription></GroupDescription>WN12-SO-000076The default permissions of global system objects must be increased.<VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing nonadministrative users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24633-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Session Manager\ - -Value Name: ProtectionMode - -Value Type: REG_DWORD -Value: 1Idle Time Before Suspending a Session.<GroupDescription></GroupDescription>WN12-SO-000031The amount of idle time required before suspending a session must be properly set.<VulnDiscussion>Open sessions can increase the avenues of attack on a system. This setting is used to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. This protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23897-2CCI-001133CCI-002361Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Server: Amount of idle time required before suspending session" to "15" minutes or less.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: autodisconnect - -Value Type: REG_DWORD -Value: 0x0000000f (15) (or less)Reversible Password Encryption<GroupDescription></GroupDescription>WN12-AC-000009Reversible password encryption must be disabled.<VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23951-7CCI-000196Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Store password using reversible encryption" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. - -If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding.Disable Media Autoplay<GroupDescription></GroupDescription>WN12-CC-000074Autoplay must be disabled for all drives.<VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables Autoplay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23878-2CCI-001764Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Turn off AutoPlay" to "Enabled:All Drives".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ - -Value Name: NoDriveTypeAutoRun - -Type: REG_DWORD -Value: 0x000000ff (255)Kerberos-User Logon Restrictions<GroupDescription></GroupDescription>WN12-AC-000010-DCKerberos user logon restrictions must be enforced.<VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default which is the most secure setting for validating access to target resources is not circumvented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23796-6CCI-000366Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Enforce user logon restrictions" to "Enabled".Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest > Domains > Domain). -Right click on the "Default Domain Policy". -Select Edit. -Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy. - -If the "Enforce user logon restrictions" is not set to "Enabled", this is a finding.Kerberos-Service Ticket Lifetime<GroupDescription></GroupDescription>WN12-AC-000011-DCThe Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.<VulnDiscussion>This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23419-5CCI-000366Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum lifetime for service ticket" to a maximum of 600 minutes, but not 0 which equates to "Ticket doesn't expire".Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest > Domains > Domain). -Right click on the "Default Domain Policy". -Select Edit. -Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy. - -If the value for "Maximum lifetime for service ticket" is 0 or greater than 600 minutes, this is a finding.Kerberos - User Ticket Lifetime<GroupDescription></GroupDescription>WN12-AC-000012-DCThe Kerberos user ticket lifetime must be limited to 10 hours or less.<VulnDiscussion>In Kerberos, there are 2 types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user's initial authentication to the domain controller results in a TGT which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that startup under a specified user account, users must always get a TGT first, then get Service Tickets to all computers and services accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24230-5CCI-000366Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum lifetime for user ticket" to a maximum of 10 hours, but not 0 which equates to "Ticket doesn't expire".Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest > Domains > Domain). -Right click on the "Default Domain Policy". -Select Edit. -Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy. - -If the value for "Maximum lifetime for user ticket" is 0 or greater than 10 hours, this is a finding.Kerberos-User Ticket Renewal<GroupDescription></GroupDescription>WN12-AC-000013-DCThe Kerberos policy user ticket renewal maximum lifetime must be limited to 7 days or less.<VulnDiscussion>This setting determines the period of time (in days) during which a user's TGT may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24125-7CCI-000366Configure the policy value in the Default Domain Policy for Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum lifetime for user ticket renewal" to a maximum of 7 days or less.Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest > Domains > Domain). -Right click on the "Default Domain Policy". -Select Edit. -Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy. - -If the "Maximum lifetime for user ticket renewal" is greater than 7 days, this is a finding.Kerberos - Computer Clock Sync<GroupDescription></GroupDescription>WN12-AC-000014-DCThe computer clock synchronization tolerance must be limited to 5 minutes or less.<VulnDiscussion>This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. In order to prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25365-8CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy -> "Maximum tolerance for computer clock synchronization" to a maximum of 5 minutes or less.Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest > Domains > Domain). -Right click on the "Default Domain Policy". -Select Edit. -Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy. - -If the "Maximum tolerance for computer clock synchronization" is greater than 5 minutes, this is a finding.System File Changes<GroupDescription></GroupDescription>WN12-GE-000017System files must be monitored for unauthorized changes.<VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>DCSL-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Monitor system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. This can be done with the use of various monitoring tools.Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a finding. - -A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.File share ACLs<GroupDescription></GroupDescription>WN12-GE-000018Non system-created file shares on a system must limit access to groups that require it.<VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to those accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001090If a non-system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. - -Remove any unnecessary non-system-created shares.If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. -(System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) - -Run "Computer Management". -Navigate to System Tools >> Shared Folders >> Shares. - -Right click any non-system-created shares. -Select "Properties". -Select the "Share Permissions" tab. - -If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. - -Select the "Security" tab. - -If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.Intrusion Detection System<GroupDescription></GroupDescription>WN12-GE-000022Servers must have a host-based Intrusion Detection System.<VulnDiscussion>A properly configured host-based Intrusion Detection System provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>This finding can be downgraded to a CAT III, if there is an active JIDS or firewall protecting the network. </SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install a host-based Intrusion Detection System on each server.Determine whether there is a host-based Intrusion Detection System on each server. - -If the HIPS component of HBSS is installed and active on the host and the Alerts of blocked activity are being logged and monitored, this will meet the requirement of this finding. - -A HID device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the site ISSO. - -If a host-based Intrusion Detection System is not installed on the system, this is a finding.Anonymous SID/Name Translation<GroupDescription></GroupDescription>WN12-SO-000050Anonymous SID/Name translation must not be allowed.<VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24597-7CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Allow anonymous SID/Name translation" to "Disabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. - -If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.Anonymous Access to Named Pipes<GroupDescription></GroupDescription>WN12-SO-000055-DCNamed pipes that can be accessed anonymously must be configured with limited values on domain controllers.<VulnDiscussion>Named pipes that can be accessed anonymously provide the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Named pipes that can be accessed anonymously" to only include "netlogon, samr, lsarpc".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: NullSessionPipes - -Value Type: REG_MULTI_SZ -Value: netlogon, samr, lsarpc - -The default configuration of systems promoted to domain controllers may include a blank entry in the first line prior to "netlogon", "samr", and "lsarpc". This will appear in the registry as a blank entry when viewing the registry key summary; however the value data for "NullSessionPipes" will contain the default entries. - -Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.Remotely Accessible Registry Paths<GroupDescription></GroupDescription>WN12-SO-000056Unauthorized remotely accessible registry paths must not be configured.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23899-8CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths" with the following entries: - -System\CurrentControlSet\Control\ProductOptions -System\CurrentControlSet\Control\Server Applications -Software\Microsoft\Windows NT\CurrentVersionIf the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\ - -Value Name: Machine - -Value Type: REG_MULTI_SZ -Value: see below - -System\CurrentControlSet\Control\ProductOptions -System\CurrentControlSet\Control\Server Applications -Software\Microsoft\Windows NT\CurrentVersion - -Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.Anonymous Access to Network Shares<GroupDescription></GroupDescription>WN12-SO-000059Network shares that can be accessed anonymously must not be allowed.<VulnDiscussion>Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25592-7CCI-001090Ensure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Shares that can be accessed anonymously" contains no entries (blank).If the following registry value does not exist, this is not a finding: - -If the following registry value does exist and is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: NullSessionShares - -Value Type: REG_MULTI_SZ -Value: (Blank)Remote Assistance - Solicit Remote Assistance<GroupDescription></GroupDescription>WN12-CC-000059Solicited Remote Assistance must not be allowed.<VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25590-1CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Solicited Remote Assistance" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fAllowToGetHelp - -Type: REG_DWORD -Value: 0Limit Blank Passwords<GroupDescription></GroupDescription>WN12-SO-000004Local accounts with blank passwords must be restricted to prevent access from the network.<VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25589-3CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: LimitBlankPasswordUse - -Value Type: REG_DWORD -Value: 1Maximum Machine Account Password Age<GroupDescription></GroupDescription>WN12-SO-000016The maximum age for machine account passwords must be set to requirements.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23596-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Maximum machine account password age" to "30" or less (excluding "0" which is unacceptable).If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: MaximumPasswordAge - -Value Type: REG_DWORD -Value: 30 (or less, but not 0)Strong Session Key<GroupDescription></GroupDescription>WN12-SO-000017The system must be configured to require a strong session key.<VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25198-3CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RequireStrongKey - -Value Type: REG_DWORD -Value: 1 - -This setting may prevent a system from being joined to a domain if not configured consistently between systems.Everyone Anonymous rights<GroupDescription></GroupDescription>WN12-SO-000054The system must be configured to prevent anonymous users from having the same rights as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23807-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Let everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: EveryoneIncludesAnonymous - -Value Type: REG_DWORD -Value: 0Sharing and Security Model for Local Accounts<GroupDescription></GroupDescription>WN12-SO-000060The system must be configured to use the Classic security model.<VulnDiscussion>Windows includes two network-sharing security models - Classic and Guest only. With the Classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-22742-1CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Sharing and security model for local accounts" to "Classic - local users authenticate as themselves".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: ForceGuest - -Value Type: REG_DWORD -Value: 0LAN Manager Hash stored<GroupDescription></GroupDescription>WN12-SO-000065The system must be configured to prevent the storage of the LAN Manager hash of passwords.<VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24150-5CCI-000196Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: NoLMHash - -Value Type: REG_DWORD -Value: 1Force Logoff When Logon Hours Expire<GroupDescription></GroupDescription>WN12-SO-000066The system must be configured to force users to log off when their allowed logon hours expire.<VulnDiscussion>Limiting logon hours can help protect data by only allowing access during specified times. This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, this must be enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25367-4CCI-001133Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Force logoff when logon hours expire" to "Enabled".Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. - -If the value for "Network security: Force logoff when logon hours expire" is not set to "Enabled", this is a finding.LDAP Client Signing<GroupDescription></GroupDescription>WN12-SO-000068The system must be configured to the required LDAP client signing level.<VulnDiscussion>This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25245-2CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LDAP\ - -Value Name: LDAPClientIntegrity - -Value Type: REG_DWORD -Value: 1Session Security for NTLM SSP Based Clients<GroupDescription></GroupDescription>WN12-SO-000069The system must be configured to meet the minimum session security requirement for NTLM SSP-based clients.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24783-3CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ - -Value Name: NTLMMinClientSec - -Value Type: REG_DWORD -Value: 0x20080000 (537395200)FIPS Compliant Algorithms <GroupDescription></GroupDescription>WN12-SO-000074The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.<VulnDiscussion>This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23921-0CCI-002450Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ - -Value Name: Enabled - -Value Type: REG_DWORD -Value: 1 - -Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS, or the browser will not be able to connect to a secure site.Case Insensitivity for Non-Windows<GroupDescription></GroupDescription>WN12-SO-000075The system must be configured to require case insensitivity for non-Windows subsystems.<VulnDiscussion>This setting controls the behavior of non-Windows subsystems when dealing with the case of arguments or commands. Case sensitivity could lead to the access of files or commands that must be restricted. To prevent this from happening, case insensitivity restrictions must be required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24870-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Require case insensitivity for non-Windows subsystems" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Session Manager\Kernel\ - -Value Name: ObCaseInsensitive - -Value Type: REG_DWORD -Value: 1TS/RDS - Session Limit<GroupDescription></GroupDescription>WN12-CC-000131Remote Desktop Services must limit users to one remote session.<VulnDiscussion>Allowing multiple Remote Desktop Services sessions could consume resources. There is also potential to make a secondary connection to a system with compromised credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLO-1, ECLO-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23328-8CCI-000054Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections -> "Restrict Remote Desktop Services users to a single Remote Desktop Services Session" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fSingleSessionPerUser - -Type: REG_DWORD -Value: 1TS/RDS - Password Prompting<GroupDescription></GroupDescription>WN12-CC-000099Remote Desktop Services must always prompt a client for passwords upon connection.<VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25016-7CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Always prompt for password upon connection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fPromptForPassword - -Type: REG_DWORD -Value: 1TS/RDS - Set Encryption Level<GroupDescription></GroupDescription>WN12-CC-000100Remote Desktop Services must be configured with the client connection encryption set to the required level.<VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24932-6CCI-000068CCI-002890Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Set client connection encryption level" to "Enabled" and "High Level".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: MinEncryptionLevel - -Type: REG_DWORD -Value: 3TS/RDS - Do Not Use Temp Folders<GroupDescription></GroupDescription>WN12-CC-000104Remote Desktop Services must be configured to use session-specific temporary folders.<VulnDiscussion>If a communal temporary folder is used for remote desktop sessions, it might be possible for users to access other users' temporary folders. If this setting is enabled, only one temporary folder is used for all remote desktop sessions. Per session temporary folders must be established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24042-4CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders -> "Do not use temporary folders per session" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: PerSessionTempDir - -Type: REG_DWORD -Value: 1TS/RDS - Delete Temp Folders<GroupDescription></GroupDescription>WN12-CC-000103Remote Desktop Services must delete temporary folders when a session is terminated.<VulnDiscussion>Remote desktop session temporary folders must always be deleted after a session is over to prevent hard disk clutter and potential leakage of information. This setting controls the deletion of the temporary folders when the session is terminated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24304-8CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders -> "Do not delete temp folder upon exit" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: DeleteTempDirsOnExit - -Type: REG_DWORD -Value: 1Group Policy - Do Not Turn off Background Refresh<GroupDescription></GroupDescription>WN12-CC-000029Group Policies must be refreshed in the background if the user is logged on.<VulnDiscussion>If this setting is enabled, then Group Policy settings are not refreshed while a user is currently logged on. This could lead to instances when a user does not have the latest changes to a policy applied and is therefore operating in an insecure context.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23622-4CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy -> "Turn off background refresh of Group Policy" to "Disabled".Review the registry. -If the following registry value does not exist, this is not a finding (this is the expected result from configuring the policy as outlined in the Fix section.): -If the following registry value exists but is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\system\ - -Value Name: DisableBkGndGroupPolicy - -Type: REG_DWORD -Value: 0Remote Assistance - Offer Remote Assistance<GroupDescription></GroupDescription>WN12-CC-000058The system must be configured to prevent unsolicited remote assistance offers.<VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Unsolicited remote assistance is help that is offered by the remote user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23282-7CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Offer Remote Assistance" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fAllowUnsolicited - -Type: REG_DWORD -Value: 0Windows Time Service - Configure NTP Client<GroupDescription></GroupDescription>WN12-CC-000069The time service must synchronize with an appropriate DoD time source.<VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23563-0CCI-001891If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an authorized time server. - -The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.Open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator). - -Enter "W32tm /query /configuration". - -Domain-joined systems are automatically configured with a "Type" of "NT5DS" to synchronize with domain controllers and would not be a finding. - -If systems are configured with a "Type" of "NTP", including standalone systems and the forest root domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. (See V-8557 in the Active Directory Forest STIG for the time source requirement of the forest root domain PDC emulator.) - -If an alternate time synchronization tool is used and is not enabled or not configured to synchronize with a DoD time source, this is a finding. - -The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.Safe DLL Search Mode<GroupDescription></GroupDescription>WN12-SO-000045The system must be configured to use Safe DLL Search Mode.<VulnDiscussion>The default search behavior, when an application calls a function in a Dynamic Link Library (DLL), is to search the current directory, followed by the directories contained in the system's path environment variable. An unauthorized DLL, inserted into an application's working directory, could allow malicious code to be run on the system. Setting this policy value forces the system to search the %Systemroot% for the DLL before searching the current directory or the rest of the path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23462-5CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)" to "Enabled". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Session Manager\ - -Value Name: SafeDllSearchMode - -Value Type: REG_DWORD -Value: 1Media Player - Disable Automatic Updates<GroupDescription></GroupDescription>WN12-CC-000122Windows Media Player must be configured to prevent automatic checking for updates.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. The automatic check for updates performed by Windows Media Player must be disabled to ensure a constant platform and to prevent the introduction of unknown\untested software on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24250-3CCI-001812If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Prevent Automatic Updates" to "Enabled".Windows Media Player is not installed by default. If it is not installed, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ - -Value Name: DisableAutoupdate - -Type: REG_DWORD -Value: 1Media Player - Prevent Codec Download<GroupDescription></GroupDescription>WN12-UC-000013Media Player must be configured to prevent automatic Codec downloads.<VulnDiscussion>The Windows Media Player uses software components, referred to as Codecs, to play back media files. By default, when an unknown file type is opened with the Media Player, it will search the Internet for the appropriate Codec and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all Codecs must be installed by the System Administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23890-7CCI-001812Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> Playback -> "Prevent Codec Download" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ - -Value Name: PreventCodecDownload - -Type: REG_DWORD -Value: 1Unnecessary Services<GroupDescription></GroupDescription>WN12-GE-000021Necessary services must be documented to maintain a baseline to determine if additional, unnecessary services have been added to a system.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some services may be run under the local System account, which generally has more permissions than required by the service. Compromising a service could allow an intruder to obtain system permissions and open the system to a variety of attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381Document the services required for the system to operate. Remove or disable any services that are not required.Required services will vary between organizations, and on the role of the individual system. Organizations will develop their own list of services which will be documented and justified with the ISSO. The site's list will be provided for any security review. Services common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system. - -Individual services specifically required to be disabled per the STIG are identified in separate requirements. - -If the site has not documented the services required for their system(s), this is a finding. - -The following can be used to view the services on a system: -Run "Services.msc". - -Services for Windows Server 2012 roles are managed automatically, adding those necessary for a particular role. The following lists the default services for a baseline installation as a reference. This can be used as a basis for documenting the services necessary. - -Default Installation -Name - Startup Type -Application Experience - Manual (Trigger Start) -Application Identity - Manual (Trigger Start) -Application Information - Manual -Application Layer Gateway Service - Manual -Application Management - Manual -Background Intelligent Transfer Service - Automatic (Delayed Start) -Background Tasks Infrastructure Service - Automatic -Base Filtering Engine - Automatic -Certificate Propagation - Manual -CNG Key Isolation - Manual (Trigger Start) -COM+ Event System - Automatic -COM+ System Application - Manual -Computer Browser - Disabled -Credential Manager - Manual -Cryptographic Services - Automatic -DCOM Server Process Launcher - Automatic -Device Association Service - Manual (Trigger Start) -Device Install Service - Manual (Trigger Start) -Device Setup Manager - Manual (Trigger Start) -DHCP Client - Automatic -Diagnostic Policy Service - Automatic (Delayed Start) -Diagnostic Service Host - Manual -Diagnostic System Host - Manual -Distributed Link Tracking Client - Automatic -Distributed Transaction Coordinator - Automatic (Delayed Start) -DNS Client - Automatic (Trigger Start) -Encrypting File System (EFS) - Manual (Trigger Start) -Extensible Authentication Protocol - Manual -Function Discovery Provider Host - Manual -Function Discovery Resource Publication - Manual -Group Policy Client - Automatic (Trigger Start) -Health Key and Certificate Management - Manual -Human Interface Device Access - Manual (Trigger Start) -Hyper-V Data Exchange Service - Manual (Trigger Start) -Hyper-V Guest Shutdown Service - Manual (Trigger Start) -Hyper-V Heartbeat Service - Manual (Trigger Start) -Hyper-V Remote Desktop Virtualization Service - Manual (Trigger Start) -Hyper-V Time Synchronization Service - Manual (Trigger Start) -Hyper-V Volume Shadow Copy Requestor - Manual (Trigger Start) -IKE and AuthIP IPsec Keying Modules - Manual (Trigger Start) -Interactive Services Detection - Manual -Internet Connection Sharing (ICS) - Disabled -IP Helper - Automatic -IPsec Policy Agent - Manual (Trigger Start) -KDC Proxy Server service (KPS) - Manual -KtmRm for Distributed Transaction Coordinator - Manual (Trigger Start) -Link-Layer Topology Discovery Mapper - Manual -Local Session Manager - Automatic -Microsoft iSCSI Initiator Service - Manual -Microsoft Software Shadow Copy Provider - Manual -Multimedia Class Scheduler - Manual -Net.Tcp Port Sharing Service - Disabled -Netlogon - Manual -Network Access Protection Agent - Manual -Network Connections - Manual -Network Connectivity Assistant - Manual (Trigger Start) -Network List Service - Manual -Network Location Awareness - Automatic -Network Store Interface Service - Automatic -Optimize drives - Manual -Performance Counter DLL Host - Manual -Performance Logs & Alerts - Manual -Plug and Play - Manual -Portable Device Enumerator Service - Manual (Trigger Start) -Power - Automatic -Print Spooler - Automatic -Printer Extensions and Notifications - Manual -Problem Reports and Solutions Control Panel Support - Manual -Remote Access Auto Connection Manager - Manual -Remote Access Connection Manager - Manual -Remote Desktop Configuration - Manual -Remote Desktop Services - Manual -Remote Desktop Services UserMode Port Redirector - Manual -Remote Procedure Call (RPC) - Automatic -Remote Procedure Call (RPC) Locator - Manual -Remote Registry - Automatic (Trigger Start) -Resultant Set of Policy Provider - Manual -Routing and Remote Access - Disabled -RPC Endpoint Mapper - Automatic -Secondary Logon - Manual -Secure Socket Tunneling Protocol Service - Manual -Security Accounts Manager - Automatic -Server - Automatic -Shell Hardware Detection - Automatic -Smart Card - Disabled -Smart Card Removal Policy - Manual -SNMP Trap - Manual -Software Protection - Automatic (Delayed Start, Trigger Start) -Special Administration Console Helper - Manual -Spot Verifier - Manual (Trigger Start) -SSDP Discovery - Disabled -Superfetch - Manual -System Event Notification Service - Automatic -Task Scheduler - Automatic -TCP/IP NetBIOS Helper - Automatic (Trigger Start) -Telephony - Manual -Themes - Automatic -Thread Ordering Server - Manual -UPnP Device Host - Disabled -User Access Logging Service - Automatic (Delayed Start) -User Profile Service - Automatic -Virtual Disk - Manual -Volume Shadow Copy - Manual -Windows All-User Install Agent - Manual (Trigger Start) -Windows Audio - Manual -Windows Audio Endpoint Builder - Manual -Windows Color System - Manual -Windows Driver Foundation - User-mode Driver Framework - Manual (Trigger Start) -Windows Error Reporting Service - Manual (Trigger Start) -Windows Event Collector - Manual -Windows Event Log - Automatic -Windows Firewall - Automatic -Windows Font Cache Service - Automatic -Windows Installer - Manual -Windows Licensing Monitoring Service - Automatic -Windows Management Instrumentation - Automatic -Windows Modules Installer - Manual -Windows Remote Management (WS-Management) - Automatic -Windows Store Service (WSService) - Manual (Trigger Start) -Windows Time - Manual (Trigger Start) -Windows Update - Manual -WinHTTP Web Proxy Auto-Discovery Service - Manual -Wired AutoConfig - Manual -WMI Performance Adapter - Manual -Workstation - AutomaticSession Security for NTLM SSP based Servers<GroupDescription></GroupDescription>WN12-SO-000070The system must be configured to meet the minimum session security requirement for NTLM SSP-based servers.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25264-3CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ - -Value Name: NTLMMinServerSec - -Value Type: REG_DWORD -Value: 0x20080000 (537395200)Audit Log Warning Level<GroupDescription></GroupDescription>WN12-SO-000049The system must generate an audit event when the audit log reaches a percentage of full threshold.<VulnDiscussion>When the audit log reaches a given percent full, an audit event is written to the security log. It is recorded as a successful audit event under the category of System. This option may be especially useful if the audit logs are set to be cleared manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25110-8CCI-000139CCI-001855CCI-001858Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning" to "90" or less. - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the system is configured to write to an audit server, or is configured to automatically archive full logs, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Eventlog\Security\ - -Value Name: WarningLevel - -Value Type: REG_DWORD -Value: 90 (or less)Disable IP Source Routing<GroupDescription></GroupDescription>WN12-SO-000038The system must be configured to prevent IP source routing.<VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24968-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: DisableIPSourceRouting - -Value Type: REG_DWORD -Value: 2Disable ICMP Redirect<GroupDescription></GroupDescription>WN12-SO-000039The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.<VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24977-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: EnableICMPRedirect - -Value Type: REG_DWORD -Value: 0Disable Router Discovery<GroupDescription></GroupDescription>WN12-SO-000044The system must be configured to disable the Internet Router Discovery Protocol (IRDP).<VulnDiscussion>The Internet Router Discovery Protocol (IRDP) is used to detect and configure default gateway addresses on the computer. If a router is impersonated on a network, traffic could be routed through the compromised system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23677-8CCI-002385Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)" to "Disabled". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: PerformRouterDiscovery - -Value Type: REG_DWORD -Value: 0TCP Connection Keep-Alive Time<GroupDescription></GroupDescription>WN12-SO-000041The system must be configured to limit how often keep-alive packets are sent.<VulnDiscussion>This setting controls how often TCP sends a keep-alive packet in attempting to verify that an idle connection is still intact. A higher value could allow an attacker to cause a denial of service with numerous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24310-5CCI-002385Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds" to "300000 or 5 minutes (recommended)" or less. - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: KeepAliveTime - -Value Type: REG_DWORD -Value: 300000 (or less)Name-Release Attacks<GroupDescription></GroupDescription>WN12-SO-000043The system must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23715-6CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ - -Value Name: NoNameReleaseOnDemand - -Value Type: REG_DWORD -Value: 1LDAP Signing Requirements<GroupDescription></GroupDescription>WN12-SO-000090-DCDomain controllers must require LDAP access signing.<VulnDiscussion>Unsigned network traffic is susceptible to man in the middle attacks where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker could cause a client to make decisions based on false records from the LDAP directory. You can lower the risk of an attacker pulling this off in a corporate network by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPSec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man in the middle attacks extremely difficult.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23587-9CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain controller: LDAP server signing requirements" to "Require signing".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\NTDS\Parameters\ - -Value Name: LDAPServerIntegrity - -Value Type: REG_DWORD -Value: 2Computer Account Password Change<GroupDescription></GroupDescription>WN12-SO-000091-DCDomain controllers must be configured to allow reset of machine account passwords.<VulnDiscussion>Enabling this setting on all domain controllers in a domain prevents domain members from changing their computer account passwords. If these passwords are weak or compromised, the inability to change them may leave these computers vulnerable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24692-6CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain controller: Refuse machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RefusePasswordChange - -Value Type: REG_DWORD -Value: 0TCP Data Retransmissions<GroupDescription></GroupDescription>WN12-SO-000048The system must limit how many times unacknowledged TCP data is retransmitted.<VulnDiscussion>In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25455-7CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: TcpMaxDataRetransmissions - -Value Type: REG_DWORD -Value: 3 (or less)Screen Saver Grace Period<GroupDescription></GroupDescription>WN12-SO-000046The system must be configured to have password protection take effect within a limited time frame when the screen saver becomes active.<VulnDiscussion>Allowing more than several seconds makes the computer vulnerable to a potential attack from someone walking up to the console to attempt to log on to the system before the lock takes effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24993-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)" to "5" or less. - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: ScreenSaverGracePeriod - -Value Type: REG_SZ -Value: 5 (or less)Remotely Accessible Registry Paths and Sub-Paths<GroupDescription></GroupDescription>WN12-SO-000057Unauthorized remotely accessible registry paths and sub-paths must not be configured.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths and sub-paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25426-8CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths and sub-paths" with the following entries: - -Software\Microsoft\OLAP Server -Software\Microsoft\Windows NT\CurrentVersion\Perflib -Software\Microsoft\Windows NT\CurrentVersion\Print -Software\Microsoft\Windows NT\CurrentVersion\Windows -System\CurrentControlSet\Control\ContentIndex -System\CurrentControlSet\Control\Print\Printers -System\CurrentControlSet\Control\Terminal Server -System\CurrentControlSet\Control\Terminal Server\UserConfig -System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration -System\CurrentControlSet\Services\Eventlog -System\CurrentControlSet\Services\SysmonlogIf the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\ - -Value Name: Machine - -Value Type: REG_MULTI_SZ -Value: see below - -Software\Microsoft\OLAP Server -Software\Microsoft\Windows NT\CurrentVersion\Perflib -Software\Microsoft\Windows NT\CurrentVersion\Print -Software\Microsoft\Windows NT\CurrentVersion\Windows -System\CurrentControlSet\Control\ContentIndex -System\CurrentControlSet\Control\Print\Printers -System\CurrentControlSet\Control\Terminal Server -System\CurrentControlSet\Control\Terminal Server\UserConfig -System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration -System\CurrentControlSet\Services\Eventlog -System\CurrentControlSet\Services\Sysmonlog - -Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.Optional Subsystems<GroupDescription></GroupDescription>WN12-SO-000088Optional Subsystems must not be permitted to operate on the system.<VulnDiscussion>The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX Subsystem is required if the server supports applications that use that subsystem. The subsystem introduces a security risk relating to processes that can potentially persist across logins. That is, if a user starts a process and then logs out, there is a potential that the next user who logs in to the system could access the previous users process. This is dangerous because the process started by the first user may retain that users system privileges, and anything the second user does with that process will be performed with the privileges of the first user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools>HK</ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24878-1CCI-000381Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System settings: Optional subsystems" to "Blank" (Configured with no entries).If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Session Manager\Subsystems\ - -Value Name: Optional - -Value Type: REG_MULTI_SZ -Value: (Blank)TS/RDS - Secure RPC Connection.<GroupDescription></GroupDescription>WN12-CC-000130The Remote Desktop Session Host must require secure RPC communications.<VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24788-2CCI-001453Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Require secure RPC communication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fEncryptRPCTraffic - -Type: REG_DWORD -Value: 1Group Policy - Registry Policy Processing<GroupDescription></GroupDescription>WN12-CC-000028Group Policy objects must be reprocessed even if they have not changed.<VulnDiscussion>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24992-0CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy -> "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ - -Value Name: NoGPOListChanges - -Type: REG_DWORD -Value: 0Encrypting and Signing of Secure Channel Traffic<GroupDescription></GroupDescription>WN12-SO-000012Outgoing secure channel traffic must be encrypted or signed.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24465-7CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RequireSignOrSeal - -Value Type: REG_DWORD -Value: 1SMB Client Packet Signing (Always)<GroupDescription></GroupDescription>WN12-SO-000028The Windows SMB client must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24969-8CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: RequireSecuritySignature - -Value Type: REG_DWORD -Value: 1SMB Server Packet Signing (Always)<GroupDescription></GroupDescription>WN12-SO-000032The Windows SMB server must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23716-4CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: RequireSecuritySignature - -Value Type: REG_DWORD -Value: 1Anonymous Access to Named Pipes and Shares<GroupDescription></GroupDescription>WN12-SO-000058Anonymous access to Named Pipes and Shares must be restricted.<VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24564-7CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: RestrictNullSessAccess - -Value Type: REG_DWORD -Value: 1Minimum Password Length<GroupDescription></GroupDescription>WN12-AC-000007Passwords must, at a minimum, be 14 characters.<VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25317-9CCI-000205Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Minimum password length" to "14" characters.Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. - -If the value for the "Minimum password length," is less than "14" characters, this is a finding.Password Expiration<GroupDescription></GroupDescription>WN12-GE-000016Windows 2012/2012 R2 passwords must be configured to expire.<VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000199Configure all enabled user account passwords to expire. - -Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone systems. Document any exceptions with the ISSO.Review the password never expires status for enabled user accounts. - -Open "Windows PowerShell" with elevated privileges (run as administrator). - -Domain Controllers: - -Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | Where PasswordNeverExpires -eq True | FT Name, PasswordNeverExpires, Enabled". - -Exclude application accounts and disabled accounts (e.g., Guest). -Domain accounts requiring smart card (CAC/PIV) may also be excluded. - -If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. - -Member servers and standalone systems: - -Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. - -Exclude application accounts and disabled accounts (e.g., Guest). - -If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.Password Requirement<GroupDescription></GroupDescription>WN12-GE-000015Windows 2012/2012 R2 accounts must be configured to require passwords.<VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000764Configure all enabled accounts to require passwords. - -The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.Review the password required status for enabled user accounts. - -Open "Windows PowerShell". - -Domain Controllers: - -Enter "Get-ADUser -Filter * -Properties PasswordNotRequired | Where PasswordNotRequired -eq True | FT Name, PasswordNotRequired, Enabled". - -Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs). - -If "PasswordNotRequired" is "True" for any enabled user account, this is a finding. - -Member servers and standalone systems: - -Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. - -Exclude disabled accounts (e.g., Guest). - -If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.Data File Access Permissions<GroupDescription></GroupDescription>WN12-AD-000001-DCActive Directory data files must have proper access control permissions.<VulnDiscussion>Improper access permissions for directory data related files could allow unauthorized users to read, modify, or delete directory data or audit trails.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Ensure the permissions on NTDS database and log files are at least as restrictive as the following: -NT AUTHORITY\SYSTEM:(I)(F) -BUILTIN\Administrators:(I)(F) - -(I) - permission inherited from parent container -(F) - full accessVerify the permissions on the content of the NTDS directory. - -Open the registry editor (regedit). -Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters. -Note the directory locations in the values for: -Database log files path -DSA Database file - -By default they will be \Windows\NTDS. If the locations are different, the following will need to be run for each. - -Open an elevated command prompt (Win+x, Command Prompt (Admin)). -Navigate to the NTDS directory (\Windows\NTDS by default). -Run "icacls *.*". - -If the permissions on each file are not at least as restrictive as the following, this is a finding. - -NT AUTHORITY\SYSTEM:(I)(F) -BUILTIN\Administrators:(I)(F) - -(I) - permission inherited from parent container -(F) - full access - -Do not use File Explorer to attempt to view permissions of the NTDS folder. Accessing the folder through File Explorer will change the permissions on the folder.Directory Server Data File Locations<GroupDescription></GroupDescription>WN12-AD-000006-DCData files owned by users must be on a different logical partition from the directory server data files.<VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. - -The directory service may be vulnerable to a denial of service attack when user-owned files on a common partition are expanded to an extent preventing the directory service from acquiring more space for directory or audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>DCSP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001082Ensure files owned by users are stored on a different logical partition then the directory server data files.Refer to the AD database location obtained in check V-8316. Note the logical drive (e.g., C:) on which the files are located. - -Determine if the server is currently providing file sharing services to users with the following command. -Enter "net share" at a command prompt. - -Note the logical drive(s) or file system partition for any site-created data shares. -Ignore all system shares (e.g., Windows NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored. - -If user shares are located on the same logical partition as the directory server data files, this is a finding.Time Synchronization<GroupDescription></GroupDescription>WN12-AD-000007-DCTime synchronization must be enabled on the domain controller.<VulnDiscussion>When a directory service using multi-master replication (such as AD) executes on computers that do not have synchronized time, directory data may be corrupted or updated invalidly. - -The lack of synchronized time could lead to audit log data that is misleading, inconclusive, or unusable. In cases of intrusion this may invalidate the audit data as a source of forensic evidence in an incident investigation. - -In AD, the lack of synchronized time could prevent clients from logging on or accessing server resources as a result of Kerberos requirements related to time variance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTM-1, ECTM-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001891Ensure the Windows Time Service is configured as follows or install and enable another time synchronization tool. - -Registry Hive: HKEY_LOCAL_MACHINE - -Registry Path: \System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\ -Value Name: Enabled -Type: REG_DWORD -Value: 1 - -Registry Path: \System\CurrentControlSet\Services\W32Time\ Parameters\ -Value Name: Type -Type: REG_SZ -Value: NT5DS (preferred), NTP or AllsyncDetermine if a time synchronization tool has been implemented on the Windows domain controller. - -If the Windows Time Service is used, verify the following registry values. If they are not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE - -Registry Path: \System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\ -Value Name: Enabled -Type: REG_DWORD -Value: 1 - -Registry Path: \System\CurrentControlSet\Services\W32Time\Parameters\ -Value Name: Type -Type: REG_SZ -Value: NT5DS (preferred), NTP or Allsync - -If these Windows checks indicate a finding because the NtpClient is not enabled, determine if an alternate time synchronization tool is installed and enabled. - -If the Windows Time Service is not enabled and no alternate tool is enabled, this is a finding.Time Synchronization Source Logging<GroupDescription></GroupDescription>WN12-AD-000008-DCThe time synchronization tool must be configured to enable logging of time source switching.<VulnDiscussion>When a time synchronization tool executes, it may switch between time sources according to network or server contention. If switches between time sources are not logged, it may be difficult or impossible to detect malicious activity or availability problems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTM-1, ECTM-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Configure the time synchronization tool to log time source switching. If the Windows Time Service is used, configure the following registry value. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\W32Time\Config\ - -Value Name: EventLogFlags - -Type: REG_DWORD -Value: 2 or 3Verify logging is configured to capture time source switches. - -If the Windows Time Service is used, verify the following registry value. If it is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\W32Time\Config\ - -Value Name: EventLogFlags - -Type: REG_DWORD -Value: 2 or 3 - -If another time synchronization tool is used, review the available configuration options and logs. If the tool has time source logging capability and it is not enabled, this is a finding.Directory Server Host Dedication<GroupDescription></GroupDescription>WN12-AD-000009-DCThe directory server supporting (directly or indirectly) system access or resource authorization must run on a machine dedicated to that function.<VulnDiscussion>Executing application servers on the same host machine with a directory server may substantially weaken the security of the directory server. Web or database server applications usually require the addition of many programs and accounts increasing the attack surface of the computer. - -Some applications require the addition of privileged accounts providing potential sources of compromise. Some applications (such as MS Exchange) may require the use of network ports or services conflicting with the directory server. In this case, non-standard ports might be selected and this could interfere with intrusion detection or prevention services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>DCSP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001082Remove additional roles or applications such as web, database, and email from the domain controller.Review the roles and services the domain controller is running. -Run "services.msc" to display the Services console. - -Determine if any running services are application components. - -Examples of services indicating the presence of applications are: --DHCP Server for DHCP server --IIS Admin Service for IIS web server --Microsoft Exchange System Attendant for Exchange --MSSQLServer for SQL Server. - -If any application-related components have the "Started" status, this is a finding. - -Installed roles can be displayed by viewing Server Roles in the Add (or Remove) Roles and Features wizard. (Cancel before any changes are made.) - -Determine if any additional server roles are installed. A basic domain controller set up will include the following: --Active Directory Domain Services --DNS Server --File and Storage Services - -If any roles not requiring installation on a domain controller are installed, this is a finding. - -Supplemental Notes: -A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements. - -Some directory servers utilize specialized web servers for administrative functions and databases for data management. These web and database servers are permitted as long as they are dedicated to directory server support and only administrative users have access to them.Prerequisite OS Services Startup<GroupDescription></GroupDescription>WN12-AD-000010-DCWindows services that are critical for directory server operation must be configured for automatic startup.<VulnDiscussion>Active Directory (AD) is dependent on several Windows services. If one or more of these services is not configured for automatic startup, AD functions may be partially or completely unavailable until the services are manually started. This could result in a failure to replicate data or to support client authentication and authorization requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTM-1, ECTM-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure the following services that are critical for directory server operation are configured for automatic startup. - -- Active Directory Domain Services -- DFS Replication -- DNS Client -- DNS server -- Group Policy Client -- Intersite Messaging -- Kerberos Key Distribution Center -- NetLogon -- Windows Time (not required if another time synchronization tool is implemented to start automatically)Run "services.msc" to display the Services console. - -Verify the Startup Type for the following Windows services: -- Active Directory Domain Services -- DFS Replication -- DNS Client -- DNS server -- Group Policy Client -- Intersite Messaging -- Kerberos Key Distribution Center -- NetLogon -- Windows Time (not required if another time synchronization tool is implemented to start automatically) - -If the Startup Type for any of these services is not Automatic, this is a finding.Display of Last User Name<GroupDescription></GroupDescription>WN12-SO-000018The system must be configured to prevent the display of the last username on the logon screen.<VulnDiscussion>Displaying the username of the last logged on user provides half of the userid/password equation that an unauthorized person would need to gain access. The username of the last user to log on to a system must not be displayed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24748-6CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Do not display last user name" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: DontDisplayLastUserName - -Value Type: REG_DWORD -Value: 1Administrator Account Password Changes<GroupDescription></GroupDescription>WN12-00-000007Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The password for the built-in Administrator account must be changed at least annually or when any member of the administrative team leaves the organization. - -Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Change the built-in Administrator account password at least annually or whenever an administrator leaves the organization. More frequent changes are recommended. - -Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this.Review the password last set date for the built-in Administrator account. - -Domain controllers: - -Open "Windows PowerShell". - -Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | FL Name, SID, PasswordLastSet". - -If the "PasswordLastSet" date is greater than one year old, this is a finding. - -Member servers and standalone systems: - -Open "Windows PowerShell" or "Command Prompt". - -Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. - -(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) - -If the "PasswordLastSet" date is greater than one year old, this is a finding.Audit Access of Global System Objects<GroupDescription></GroupDescription>WN12-SO-000007Auditing the Access of Global System Objects must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24075-4CCI-001095Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the access of global system objects" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: AuditBaseObjects - -Value Type: REG_DWORD -Value: 0Audit Backup and Restore Privileges<GroupDescription></GroupDescription>WN12-SO-000008Auditing of Backup and Restore Privileges must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting prevents the system from generating audit events for every file backed up or restored, which could fill the security log in Windows, making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24923-5CCI-001095Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the use of Backup and Restore privilege" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: FullPrivilegeAuditing - -Value Type: REG_BINARY -Value: 00Audit Policy Subcategory Setting<GroupDescription></GroupDescription>WN12-SO-000009Audit policy using subcategories must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24252-9CCI-000169Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: SCENoApplyLegacyAuditPolicy - -Value Type: REG_DWORD -Value: 1IPSec Exemptions<GroupDescription></GroupDescription>WN12-SO-000042IPSec Exemptions must be limited.<VulnDiscussion>IPSec exemption filters allow specific traffic that may be needed by the system for such things as Kerberos authentication. This setting configures Windows for specific IPSec exemptions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24253-7CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic" to "Only ISAKMP is exempt (recommended for Windows Server 2003)". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\IPSEC\ - -Value Name: NoDefaultExempt - -Value Type: REG_DWORD -Value: 3UAC - Admin Approval Mode<GroupDescription></GroupDescription>WN12-SO-000077User Account Control approval mode for the built-in Administrator must be enabled.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24134-9CCI-002038UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: FilterAdministratorToken - -Value Type: REG_DWORD -Value: 1UAC - Admin Elevation Prompt<GroupDescription></GroupDescription>WN12-SO-000078User Account Control must, at minimum, prompt administrators for consent.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23877-4CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent". - -More secure options for this setting would also be acceptable (e.g., Prompt for credentials, Prompt for consent (or credentials) on the secure desktop).UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ConsentPromptBehaviorAdmin - -Value Type: REG_DWORD -Value: 4 (Prompt for consent) -3 (Prompt for credentials) -2 (Prompt for consent on the secure desktop) -1 (Prompt for credentials on the secure desktop)UAC - User Elevation Prompt<GroupDescription></GroupDescription>WN12-SO-000079User Account Control must automatically deny standard user requests for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24519-1CCI-002038UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ConsentPromptBehaviorUser - -Value Type: REG_DWORD -Value: 0UAC - Application Installations<GroupDescription></GroupDescription>WN12-SO-000080User Account Control must be configured to detect application installations and prompt for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24498-8CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableInstallerDetection - -Value Type: REG_DWORD -Value: 1UAC - UIAccess Application Elevation<GroupDescription></GroupDescription>WN12-SO-000082User Account Control must only elevate UIAccess applications that are installed in secure locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25471-4CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableSecureUIAPaths - -Value Type: REG_DWORD -Value: 1UAC - All Admin Approval Mode<GroupDescription></GroupDescription>WN12-SO-000083User Account Control must run all administrators in Admin Approval Mode, enabling UAC.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23653-9CCI-002038UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableLUA - -Value Type: REG_DWORD -Value: 1UAC - Secure Desktop Mode<GroupDescription></GroupDescription>WN12-SO-000084User Account Control must switch to the secure desktop when prompting for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting ensures that the elevation prompt is only used in secure desktop mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23656-2CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Switch to the secure desktop when prompting for elevation" to "Enabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: PromptOnSecureDesktop - -Value Type: REG_DWORD -Value: 1UAC - Non UAC Compliant Application Virtualization<GroupDescription></GroupDescription>WN12-SO-000085User Account Control must virtualize file and registry write failures to per-user locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24231-3CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableVirtualization - -Value Type: REG_DWORD -Value: 1Enumerate Administrator Accounts on Elevation<GroupDescription></GroupDescription>WN12-CC-000077Administrator accounts must not be enumerated during elevation.<VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to enter in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24805-4CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ - -Value Name: EnumerateAdministrators - -Type: REG_DWORD -Value: 0x00000000 (0)TS/RDS - Prevent Password Saving<GroupDescription></GroupDescription>WN12-CC-000096Passwords must not be saved in the Remote Desktop Client.<VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23787-5CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Connection Client -> "Do not allow passwords to be saved" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: DisablePasswordSaving - -Type: REG_DWORD -Value: 1TS/RDS - Drive Redirection<GroupDescription></GroupDescription>WN12-CC-000098Local drives must be prevented from sharing with Remote Desktop Session Hosts. (Remote Desktop Services Role).<VulnDiscussion>Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24648-8CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow drive redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fDisableCdm - -Type: REG_DWORD -Value: 1Printing Over HTTP<GroupDescription></GroupDescription>WN12-CC-000039Printing over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24832-8CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off printing over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DisableHTTPPrinting - -Type: REG_DWORD -Value: 1HTTP Printer Drivers<GroupDescription></GroupDescription>WN12-CC-000032Downloading print driver packages over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24854-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off downloading of print drivers over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DisableWebPnPDownload - -Type: REG_DWORD -Value: 1Windows Update Device Drive Searching<GroupDescription></GroupDescription>WN12-CC-000047Windows must be prevented from using Windows Update to search for drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents Windows from searching Windows Update for device drivers when no local drivers for a device are present.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24071-3CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Windows Update device driver searching" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ - -Value Name: DontSearchWindowsUpdate - -Type: REG_DWORD -Value: 1Attachment Mgr - Preserve Zone Info<GroupDescription></GroupDescription>WN12-UC-000009Zone information must be preserved when saving attachments.<VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24747-8CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> "Do not preserve zone information in file attachments" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ - -Value Name: SaveZoneInformation - -Type: REG_DWORD -Value: 2Attachment Mgr - Hide Mech to Remove Zone Info<GroupDescription></GroupDescription>WN12-UC-000010Mechanisms for removing zone information from file attachments must be hidden.<VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk. This setting prevents users from manually removing zone information from saved file attachments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24611-6CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> "Hide mechanisms to remove zone information" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ - -Value Name: HideZoneInfoOnProperties - -Type: REG_DWORD -Value: 1Attachment Mgr - Scan with Antivirus<GroupDescription></GroupDescription>WN12-UC-000011The system must notify antivirus when file attachments are opened.<VulnDiscussion>Attaching malicious files is a known avenue of attack. This setting configures the system to notify antivirus programs when a user opens a file attachment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25538-0CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> "Notify antivirus programs when opening attachments" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ - -Value Name: ScanWithAntiVirus - -Type: REG_DWORD -Value: 3Replication Encryption – Classification Factor<GroupDescription></GroupDescription>WN12-AD-000011-DCSeparate, NSA-approved (Type 1) cryptography must be used to protect the directory data-in-transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.<VulnDiscussion>Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002450Configure NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level that transfers replication data through a network cleared to a lower level than the data.With the assistance of the SA, NSO, or network reviewer as required, review the site network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted. - -Determine the classification level of the Windows domain controller. - -If the classification level of the Windows domain controller is higher than the level of the networks, review the site network diagram(s) and directory implementation documentation to determine if NSA-approved encryption is used to protect the replication network traffic. - -If the classification level of the Windows domain controller is higher than the level of the network traversed and NSA-approved encryption is not used, this is a finding.Anonymous Access to Non-Public Root DSE Data<GroupDescription></GroupDescription>WN12-AD-000012-DCAnonymous access to the root DSE of a non-public directory must be disabled.<VulnDiscussion>Allowing anonymous access to the root DSE data on a directory server provides potential attackers with a number of details about the configuration and data contents of a directory. For example, the namingContexts attribute indicates the directory space contained in the directory; the supportedLDAPVersion attribute indicates which versions of the LDAP protocol the server supports; and the supportedSASLMechanisms attribute indicates the names of supported authentication mechanisms. An attacker with this information may be able to select more precisely targeted attack tools or higher value targets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>The following network controls allow the finding severity to be downgraded to not a finding since these measures lower the risk associated with anonymous access. - -Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. - -Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAN-1, ECCD-1, ECCD-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement network protections to reduce the risk of anonymous access. - -Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. - -Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.At this time, this is a finding for all Windows domain controllers for sensitive or classified levels as Windows Active Directory Domain Services (AD DS) does not provide a method to restrict anonymous access to the root DSE on domain controllers. - -The following can be used to verify anonymous access is allowed. - -Open a command prompt (not elevated). -Run "ldp.exe". -From the Connection menu, select Bind. -Clear the User, Password, and Domain fields. -Select Simple bind for the Bind type, Click OK. - -RootDSE attributes should display, such as various namingContexts. - -Confirmation of anonymous access will be displayed at the end: -res = ldap_simple_bind_s -Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON'Anonymous Access to Non-Public Data <GroupDescription></GroupDescription>WN12-AD-000013-DCDirectory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access.<VulnDiscussion>To the extent that anonymous access to directory data (outside the root DSE) is permitted, read access control of the data is effectively disabled. If other means of controlling access (such as, network restrictions) are compromised, there may be nothing else to protect the confidentiality of sensitive directory data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access. - -Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. - -Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAN-1, ECCD-1, ECCD-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Configure directory data (outside the root DSE) of a non-public directory to prevent anonymous access. - -For AD, there are multiple configuration items that could enable anonymous access. - -Changing the access permissions on the domain naming context object (from the secure defaults) could enable anonymous access. If the check procedures indicate this is the cause, the process that was used to change the permissions should be reversed. This could have been through the Windows Support Tools ADSI Edit console (adsiedit.msc). - -The dsHeuristics option is used. This is addressed in check V-8555 in the AD Forest STIG.Verify anonymous access is not allowed to the AD domain naming context. - -Open a command prompt (not elevated). -Run "ldp.exe". -From the Connection menu, select Bind. -Clear the User, Password, and Domain fields. -Select Simple bind for the Bind type, Click OK. - -Confirmation of anonymous access will be displayed at the end: -res = ldap_simple_bind_s -Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON' - -From the Browse menu, select Search. -In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field. -Clear the Attributes field and select Run. - -Error messages should display related to bind and user not authenticated. - -If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding.Directory PKI Certificate Source - Server<GroupDescription></GroupDescription>WN12-PK-000006-DCDomain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA).<VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>If the certificates in use are issued by a CA authorized by the Components CIO, this is a CAT II finding.</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAKM-1, IAKM-2, IATS-1, IATS-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000185Obtain PKI certificates issued by the DoD PKI or an approved External Certificate Authority (ECA).Verify the source of the domain controller's server certificate. - -Run "mmc". -Select "Add/Remove Snap-in" from the File menu. -Select "Certificates" in the left pane and click the "Add >" button. -Select "Computer Account", click "Next". -Select the appropriate option for "Select the computer you want this snap-in to manage.", click "Finish". -Click "OK". -Select and expand the Certificates (Local Computer) entry in the left pane. -Select and expand the Personal entry in the left pane. -Select the Certificates entry in the left pane. -In the right pane, examine the Issued By field for the certificate to determine the issuing CA. - -If the Issued By field of the PKI certificate being used by the domain controller does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding. - - -There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: - -The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. - -DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE. -http://iase.disa.mil/pki-pke/function_pages/tools.htmlInactive Server Connections<GroupDescription></GroupDescription>WN12-AD-000014-DCThe directory service must be configured to terminate LDAP-based network connections to the directory server after five (5) minutes of inactivity.<VulnDiscussion>The failure to terminate inactive network connections increases the risk of a successful attack on the directory server. The longer an established session is in progress, the more time an attacker has to hijack the session, implement a means to passively intercept data, or compromise any protections on client access. For example, if an attacker gains control of a client computer, an existing (already authenticated) session with the directory server could allow access to the directory. The lack of confidentiality protection in LDAP-based sessions increases exposure to this vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001133Configure the directory service to terminate LDAP-based network connections to the directory server after five (5) minutes of inactivity. - -Open an elevated command prompt. -Enter "ntdsutil". -At the "ntdsutil:" prompt, enter "LDAP policies". -At the "ldap policy:" prompt, enter "connections". -At the "server connections:" prompt, enter "connect to server [host-name]". -(Where [host-name] is the computer name of the domain controller.) -At the "server connections:" prompt, enter "q". -At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to 300". -Enter "Commit Changes" to save. -Enter "Show values" to verify changes. -Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.Verify the value for MaxConnIdleTime. - -Open an elevated command prompt. -Enter "ntdsutil". -At the "ntdsutil:" prompt, enter "LDAP policies". -At the "ldap policy:" prompt, enter "connections". -At the "server connections:" prompt, enter "connect to server [host-name]". -(Where [host-name] is the computer name of the domain controller.) -At the "server connections:" prompt, enter "q". -At the "ldap policy:" prompt, enter "show values". - -If the value for MaxConnIdleTime is greater than 300 (the value for five minutes) or it is not specified, this is a finding. - -Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. - - -Alternately, Dsquery can be used to display MaxConnIdleTime: - -Open an elevated command prompt. -Enter the following command (on a single line). -dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits -The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil).PKI Authentication Req<GroupDescription></GroupDescription>WN12-PK-000008-DCActive directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), PIV-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.<VulnDiscussion>Smart cards such as the Common Access Card (CAC) support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000765CCI-000766CCI-000767CCI-000768CCI-001948Configure all user accounts, including administrator accounts, in Active Directory to enable the option "Smart card is required for interactive logon". - -Run "Active Directory Users and Computers" (Available from various menus or run "dsa.msc"): -Select the Organizational Unit (OU) where the user accounts are located. (By default this is the Users node; however, accounts may be under other organization-defined OUs.) -Right click the user account and select "Properties". -Select the "Account" tab. -Check "Smart card is required for interactive logon" in the "Account Options" area.Verify active directory user accounts, including administrators, have "Smart card is required for interactive logon" selected. - -Run "PowerShell". -Enter the following: -"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" -("DistinguishedName" may be substituted for "Name" for more detailed output.) -If any user accounts are listed, this is a finding. - -Alternately: -To view sample accounts in "Active Directory Users and Computers" (Available from various menus or run "dsa.msc"): -Select the Organizational Unit (OU) where the User accounts are located. (By default this is the Users node; however, accounts may be under other organization-defined OUs.) -Right click the sample User account and select "Properties". -Select the "Account" tab. -If any User accounts do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding.HBSS McAfee Agent<GroupDescription></GroupDescription>WN12-GE-000019The HBSS McAfee Agent must be installed.<VulnDiscussion>The McAfee Agent is the client side distributed component of McAfee ePolicy Orchestrator (McAfee ePO) which provides a secure communication channel between the ePO server and managed point products.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Deploy the McAfee Agent as detailed in accordance with the DoD HBSS STIG.Run "Services.msc". - -Verify the McAfee Agent service is running, depending on the version installed. - -Version - Service Name -McAfee Agent v5.x - McAfee Agent Service -McAfee Agent v4.x - McAfee Framework Service - -If the service is not listed or does not have a Status of "Started", this is a finding.Windows Peer to Peer Networking <GroupDescription></GroupDescription>WN12-CC-000003Windows Peer-to-Peer networking services must be turned off.<VulnDiscussion>Peer-to-Peer applications can allow unauthorized access to a system and exposure of sensitive data. This setting will turn off the Microsoft Peer-to-Peer Networking Service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24398-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Microsoft Peer-to-Peer Networking Services -> "Turn off Microsoft Peer-to-Peer Networking Services" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Peernet\ - -Value Name: Disabled - -Type: REG_DWORD -Value: 1Prohibit Network Bridge<GroupDescription></GroupDescription>WN12-CC-000004Network Bridges must be prohibited in Windows.<VulnDiscussion>A Network Bridge can connect two or more network segments, allowing unauthorized access or exposure of sensitive data. This setting prevents a Network Bridge from being installed and configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25587-7CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Prohibit installation and configuration of Network Bridge on your DNS domain network" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Network Connections\ - -Value Name: NC_AllowNetBridge_NLA - -Type: REG_DWORD -Value: 0Event Viewer Events.asp Links<GroupDescription></GroupDescription>WN12-CC-000033Event Viewer Events.asp links must be turned off.<VulnDiscussion>Viewing events is a function of administrators, who must not access the internet with privileged accounts. This setting will disable Events.asp hyperlinks in Event Viewer to prevent links to the internet from within events.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24235-4CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Event Viewer "Events.asp" links" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\EventViewer\ - -Value Name: MicrosoftEventVwrDisableLinks - -Type: REG_DWORD -Value: 1Internet File Association Service <GroupDescription></GroupDescription>WN12-CC-000038The Internet File Association service must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents unhandled file associations from using the Microsoft Web service to find an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24899-7CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Internet File Association service" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: NoInternetOpenWith - -Type: REG_DWORD -Value: 1RSS Attachment Downloads<GroupDescription></GroupDescription>WN12-CC-000105Attachments must be prevented from being downloaded from RSS feeds.<VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25340-1CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds -> "Prevent downloading of enclosures" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Internet Explorer\Feeds\ - -Value Name: DisableEnclosureDownload - -Type: REG_DWORD -Value: 1Windows Explorer – Shell Protocol Protected Mode <GroupDescription></GroupDescription>WN12-CC-000091File Explorer shell protocol must run in protected mode.<VulnDiscussion>The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23923-6CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off shell protocol protected mode" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: PreXPSP2ShellProtocolBehavior - -Type: REG_DWORD -Value: 0Windows Installer – IE Security Prompt<GroupDescription></GroupDescription>WN12-CC-000117Users must be notified if a web-based program attempts to install software.<VulnDiscussion>Users must be aware of attempted program installations. This setting ensures users are notified if a web-based program attempts to install software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23886-5CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Installer\ - -Value Name: SafeForScripting - -Type: REG_DWORD -Value: 0Windows Installer – User Control <GroupDescription></GroupDescription>WN12-CC-000115Users must be prevented from changing installation options.<VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23712-3CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Allow user control over installs" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Installer\ - -Value Name: EnableUserControl - -Type: REG_DWORD -Value: 0Windows Installer – Vendor Signed Updates<GroupDescription></GroupDescription>WN12-CC-000118Nonadministrators must be prevented from applying vendor-signed updates.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. This setting will prevent users from applying vendor-signed updates (though they may be from a trusted source).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23601-8CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Prohibit non-administrators from applying vendor signed updates" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Installer\ - -Value Name: DisableLUAPatching - -Type: REG_DWORD -Value: 1Media Player – First Use Dialog Boxes <GroupDescription></GroupDescription>WN12-CC-000121Users must not be presented with Privacy and Installation options on first use of Windows Media Player.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents users from being presented with Privacy and Installation options on first use of Windows Media Player, which could enable some communication with the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25014-2CCI-000366If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Do Not Show First Use Dialog Boxes" to "Enabled".Windows Media Player is not installed by default. If it is not installed, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ - -Value Name: GroupPrivacyAcceptance - -Type: REG_DWORD -Value: 1Network – Mapper I/O Driver <GroupDescription></GroupDescription>WN12-CC-000001The Mapper I/O network protocol (LLTDIO) driver must be disabled.<VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25156-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery -> "Turn on Mapper I/O (LLTDIO) driver" to "Disabled".If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ - -Value Name: AllowLLTDIOOndomain -Value Name: AllowLLTDIOOnPublicNet -Value Name: EnableLLTDIO -Value Name: ProhibitLLTDIOOnPrivateNet - -Type: REG_DWORD -Value: 0Network – Responder Driver <GroupDescription></GroupDescription>WN12-CC-000002The Responder network protocol driver must be disabled.<VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23931-9CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery -> "Turn on Responder (RSPNDR) driver" to "Disabled".If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ - -Value Name: AllowRspndrOndomain -Value Name: AllowRspndrOnPublicNet -Value Name: EnableRspndr -Value Name: ProhibitRspndrOnPrivateNet - -Type: REG_DWORD -Value: 0Network – WCN Wireless Configuration <GroupDescription></GroupDescription>WN12-CC-000012The configuration of wireless devices using Windows Connect Now must be disabled.<VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23804-8CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Windows Connect Now -> "Configuration of wireless settings using Windows Connect Now" to "Disabled".If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ - -Value Name: DisableFlashConfigRegistrar -Value Name: DisableInBand802DOT11Registrar -Value Name: DisableUPnPRegistrar -Value Name: DisableWPDRegistrar -Value Name: EnableRegistrars - -Type: REG_DWORD -Value: 0Network – Windows Connect Now Wizards <GroupDescription></GroupDescription>WN12-CC-000013The Windows Connect Now wizards must be disabled.<VulnDiscussion>Windows Connect Now provides wizards for tasks such as "Set up a wireless router or access point" and must not be available to users. Functions such as these may allow unauthorized connections to a system and the potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24665-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Windows Connect Now -> "Prohibit access of the Windows Connect Now wizards" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\UI\ - -Value Name: DisableWcnUi - -Type: REG_DWORD -Value: 1Device Install – PnP Interface Remote Access <GroupDescription></GroupDescription>WN12-CC-000019Remote access to the Plug and Play interface must be disabled for device installation.<VulnDiscussion>Remote access to the Plug and Play interface could potentially allow connections by unauthorized devices. This setting configures remote access to the Plug and Play interface and must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24004-4CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Allow remote access to the Plug and Play interface" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ - -Value Name: AllowRemoteRPC - -Type: REG_DWORD -Value: 0Device Install – Drivers System Restore Point<GroupDescription></GroupDescription>WN12-CC-000021A system restore point must be created when a new device driver is installed.<VulnDiscussion>A system restore point allows a rollback if an issue is encountered when a new device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23669-5CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ - -Value Name: DisableSystemRestore - -Type: REG_DWORD -Value: 0Device Install – Generic Driver Error Report<GroupDescription></GroupDescription>WN12-CC-000020An Error Report must not be sent when a generic device driver is installed.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents an error report from being sent when a generic device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23275-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Do not send a Windows error report when a generic driver is installed on a device" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ - -Value Name: DisableSendGenericDriverNotFoundToWER - -Type: REG_DWORD -Value: 1Driver Install – Device Driver Search Prompt<GroupDescription></GroupDescription>WN12-CC-000026Users must not be prompted to search Windows Update for device drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents users from being prompted to search Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24804-7CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Driver Installation -> "Turn off Windows Update device driver search prompt" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ - -Value Name: DontPromptForWindowsUpdate - -Type: REG_DWORD -Value: 1Handwriting Recognition Error Reporting<GroupDescription></GroupDescription>WN12-CC-000035Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents errors in handwriting recognition on tablet PCs from being reported to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25580-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off handwriting recognition error reporting" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\HandwritingErrorReports\ - -Value Name: PreventHandwritingErrorReports - -Type: REG_DWORD -Value: 1Power Mgmt – Password Wake on Battery<GroupDescription></GroupDescription>WN12-CC-000054Users must be prompted to authenticate on resume from sleep (on battery).<VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23998-8CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Power Management -> Sleep Settings -> "Require a password when a computer wakes (on battery)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ - -Value Name: DCSettingIndex - -Type: REG_DWORD -Value: 1Power Mgmt – Password Wake When Plugged In<GroupDescription></GroupDescription>WN12-CC-000055The user must be prompted to authenticate on resume from sleep (plugged in).<VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23698-4CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Power Management -> Sleep Settings -> "Require a password when a computer wakes (plugged in)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ - -Value Name: ACSettingIndex - -Type: REG_DWORD -Value: 1Remote Assistance – Session Logging<GroupDescription></GroupDescription>WN12-CC-000062Remote Assistance log files must be generated.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. This setting will turn on session logging for Remote Assistance connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24603-3CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Turn on session logging" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: LoggingEnabled - -Type: REG_DWORD -Value: 1Windows Explorer – Heap Termination<GroupDescription></GroupDescription>WN12-CC-000090Turning off File Explorer heap termination on corruption must be disabled.<VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23913-7CCI-002385Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off heap termination on corruption" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoHeapTerminationOnCorruption - -Type: REG_DWORD -Value: 0Media DRM – Internet Access<GroupDescription></GroupDescription>WN12-CC-000120Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This check verifies that Windows Media DRM will be prevented from accessing the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24380-8CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Digital Rights Management -> "Prevent Windows Media DRM Internet Access" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\WMDRM\ - -Value Name: DisableOnline - -Type: REG_DWORD -Value: 1User Network Sharing<GroupDescription></GroupDescription>WN12-UC-000012Users must be prevented from sharing files in their profiles.<VulnDiscussion>Allowing users to share files in their profiles may provide unauthorized access or result in the exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24063-0CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Network Sharing -> "Prevent users from sharing files within their profile" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: NoInPlaceSharing - -Type: REG_DWORD -Value: 1Software Certificate Installation Files<GroupDescription></GroupDescription>WN12-GE-000020Software certificate installation files must be removed from Windows 2012/2012 R2.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. - -This does not apply to server-based applications that have a requirement for certificate files, Adobe PreFlight certificate files, or non-certificate installation files with the same extension.Search all drives for *.p12 and *.pfx files. - -If any files with these extensions exist, this is a finding. - -This does not apply to server-based applications that have a requirement for certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.UAC - UIAccess Secure Desktop<GroupDescription></GroupDescription>WN12-SO-000086UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECCD-1, ECCD-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23295-9CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableUIADesktopToggle - -Value Type: REG_DWORD -Value: 0TS/RDS – COM Port Redirection<GroupDescription></GroupDescription>WN12-CC-000132Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24625-6CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow COM port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fDisableCcm - -Type: REG_DWORD -Value: 1TS/RDS – LPT Port Redirection<GroupDescription></GroupDescription>WN12-CC-000133Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24381-6CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow LPT port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fDisableLPT - -Type: REG_DWORD -Value: 1TS/RDS - PNP Device Redirection<GroupDescription></GroupDescription>WN12-CC-000135Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24708-0CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow supported Plug and Play device redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fDisablePNPRedir - -Type: REG_DWORD -Value: 1TS/RDS – Smart Card Device Redirection<GroupDescription></GroupDescription>WN12-CC-000134The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).<VulnDiscussion>Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24260-2CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow smart card device redirection" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fEnableSmartCard - -Type: REG_DWORD -Value: 1UAC - Application Elevations<GroupDescription></GroupDescription>WN12-SO-000081Windows must elevate all applications in User Account Control, not just signed ones.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures whether Windows elevates all applications, or only signed ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23880-8CCI-001084UAC requirements are NA on Server Core installations. - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Only elevate executables that are signed and validated" to "Disabled".UAC requirements are NA on Server Core installations. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ValidateAdminCodeSignatures - -Value Type: REG_DWORD -Value: 0Windows Customer Experience Improvement Program <GroupDescription></GroupDescription>WN12-CC-000045The Windows Customer Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting ensures the Windows Customer Experience Improvement Program is disabled so information is not passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24082-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Windows Customer Experience Improvement Program" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\SQMClient\Windows\ - -Value Name: CEIPEnable - -Type: REG_DWORD -Value: 0Help Experience Improvement Program <GroupDescription></GroupDescription>WN12-UC-000007The Windows Help Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting ensures the Windows Help Experience Improvement Program is disabled to prevent information from being passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24925-0CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Help Experience Improvement Program" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ - -Value Name: NoImplicitFeedback - -Type: REG_DWORD -Value: 1Help Ratings<GroupDescription></GroupDescription>WN12-UC-000008Windows Help Ratings feedback must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting ensures users cannot provide ratings feedback to Microsoft for Help content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25470-6CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Help Ratings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ - -Value Name: NoExplicitFeedback - -Type: REG_DWORD -Value: 1User Right - Debug Programs<GroupDescription></GroupDescription>WN12-UR-000016The Debug programs user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23648-9CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding: - -Administrators - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SPN Target Name Validation Level<GroupDescription></GroupDescription>WN12-SO-000035The service principal name (SPN) target name validation level must be turned off.<VulnDiscussion>If a service principle name (SPN) is provided by the client, it is validated against the server's list of SPNs. Implementation may disrupt file and print sharing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24502-7CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Server SPN target name validation level" to "Off".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\LanmanServer\Parameters\ - -Value Name: SmbServerNameHardeningLevel - -Type: REG_DWORD -Value: 0Computer Identity Authentication for NTLM<GroupDescription></GroupDescription>WN12-SO-000061Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.<VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25508-3CCI-000778Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow Local System to use computer identity for NTLM" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\LSA\ - -Value Name: UseMachineId - -Type: REG_DWORD -Value: 1NTLM NULL Session Fallback<GroupDescription></GroupDescription>WN12-SO-000062NTLM must be prevented from falling back to a Null session.<VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25531-5CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\LSA\MSV1_0\ - -Value Name: allownullsessionfallback - -Type: REG_DWORD -Value: 0PKU2U Online Identities Authentication<GroupDescription></GroupDescription>WN12-SO-000063PKU2U authentication using online identities must be prevented.<VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25299-9CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\LSA\pku2u\ - -Value Name: AllowOnlineID - -Type: REG_DWORD -Value: 0Kerberos Encryption Types<GroupDescription></GroupDescription>WN12-SO-000064Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.<VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. - -Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24147-1CCI-000803Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: - -AES128_HMAC_SHA1 -AES256_HMAC_SHA1 -Future encryption types - -Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ - -Value Name: SupportedEncryptionTypes - -Value Type: REG_DWORD -Value: 0x7ffffff8 (2147483640) - -Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.IPv6 Source Routing<GroupDescription></GroupDescription>WN12-SO-000037IPv6 source routing must be configured to the highest protection level.<VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24452-5CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ - -Value Name: DisableIPSourceRouting - -Type: REG_DWORD -Value: 2IPv6 TCP Data Retransmissions<GroupDescription></GroupDescription>WN12-SO-000047IPv6 TCP data retransmissions must be configured to prevent resources from becoming exhausted.<VulnDiscussion>Configuring Windows to limit the number of times that IPv6 TCP retransmits unacknowledged data segments before aborting the attempt helps prevent resources from becoming exhausted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25202-3CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. - -(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ - -Value Name: TcpMaxDataRetransmissions - -Value Type: REG_DWORD -Value: 3 (or less)Elevate when setting a network’s location<GroupDescription></GroupDescription>WN12-CC-000005Domain users must be required to elevate when setting a networks location.<VulnDiscussion>Selecting an incorrect network location may allow greater exposure of a system. Elevation is required by default on nondomain systems to change network location. This setting configures elevation to also be required on domain-joined systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23388-2CCI-001084Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Require domain users to elevate when setting a network's location" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Network Connections\ - -Value Name: NC_StdDomainUserSetLocation - -Type: REG_DWORD -Value: 1Direct Access – Route Through Internal Network<GroupDescription></GroupDescription>WN12-CC-000006All Direct Access traffic must be routed through the internal network.<VulnDiscussion>Routing all Direct Access traffic through the internal network allows monitoring and prevents split tunneling.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25221-3CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Route all traffic through the internal network" to "Enabled: Enabled State".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ - -Value Name: Force_Tunneling - -Type: REG_SZ -Value: EnabledWindows Update Point and Print Driver Search<GroupDescription></GroupDescription>WN12-CC-000016Windows Update must be prevented from searching for point and print drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent Windows from searching Windows Update for point and print drivers. Only the local driver store and server driver cache will be searched.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24139-8CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Printers -> "Extend Point and Print connection to search Windows Update" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DoNotInstallCompatibleDriverFromWindowsUpdate - -Type: REG_DWORD -Value: 1Prevent device metadata retrieval from Internet<GroupDescription></GroupDescription>WN12-CC-000022Device metadata retrieval from the Internet must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent Windows from retrieving device metadata from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24165-3CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Installation >> "Prevent device metadata retrieval from the Internet" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Device Metadata\ - -Value Name: PreventDeviceMetadataFromNetwork - -Value Type: REG_DWORD -Value: 1Prevent Windows Update for device driver search<GroupDescription></GroupDescription>WN12-CC-000024Device driver searches using Windows Update must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent the system from searching Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24777-5CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify search order for device driver source locations" to "Enabled: Do not search Windows Update".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ - -Value Name: SearchOrderConfig - -Type: REG_DWORD -Value: 0MSDT Interactive Communication<GroupDescription></GroupDescription>WN12-CC-000066Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents the MSDT from communicating with and sending collected data to Microsoft, the default support provider.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23633-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Microsoft Support Diagnostic Tool -> "Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy\ - -Value Name: DisableQueryRemoteServer - -Type: REG_DWORD -Value: 0Windows Online Troubleshooting Service<GroupDescription></GroupDescription>WN12-CC-000067Access to Windows Online Troubleshooting Service (WOTS) must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents users from searching troubleshooting content on Microsoft servers. Only local content will be available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24776-7CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Scripted Diagnostics -> "Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy\ - -Value Name: EnableQueryRemoteServer - -Type: REG_DWORD -Value: 0Disable PerfTrack<GroupDescription></GroupDescription>WN12-CC-000068Responsiveness events must be prevented from being aggregated and sent to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents responsiveness events from being aggregated and sent to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25080-3CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Windows Performance PerfTrack -> "Enable/Disable PerfTrack" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\ - -Value Name: ScenarioExecutionEnabled - -Type: REG_DWORD -Value: 0Application Compatibility Program Inventory<GroupDescription></GroupDescription>WN12-CC-000071The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25331-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Application Compatibility -> "Turn off Inventory Collector" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\AppCompat\ - -Value Name: DisableInventory - -Type: REG_DWORD -Value: 1Autoplay for non-volume devices<GroupDescription></GroupDescription>WN12-CC-000072Autoplay must be turned off for non-volume devices.<VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable Autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24715-5CCI-001764Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Disallow Autoplay for non-volume devices" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoAutoplayfornonVolume - -Type: REG_DWORD -Value: 1Explorer Data Execution Prevention<GroupDescription></GroupDescription>WN12-CC-000089Explorer Data Execution Prevention must be enabled.<VulnDiscussion>Data Execution Prevention (DEP) provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25147-0CCI-002824Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off Data Execution Prevention for Explorer" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoDataExecutionPrevention - -Type: REG_DWORD -Value: 0Default Autorun Behavior<GroupDescription></GroupDescription>WN12-CC-000073The default Autorun behavior must be configured to prevent Autorun commands.<VulnDiscussion>Allowing Autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents Autorun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25487-0CCI-001764Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Set the default behavior for AutoRun" to "Enabled:Do not execute any autorun commands".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: NoAutorun - -Type: REG_DWORD -Value: 1Winlogon Registry Permissions<GroupDescription></GroupDescription>WN12-RG-000001Standard user accounts must only have Read permissions to the Winlogon registry key.<VulnDiscussion>Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Maintain permissions at least as restrictive as the defaults listed below for the "WinLogon" registry key. It is recommended to not change the permissions from the defaults. - -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -The following are the same for each permission listed: -Type - Allow -Inherited from - MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion -Applies to - This key and subkeys - -Columns: Principal - Access -TrustedInstaller - Full Control -SYSTEM - Full Control -Administrators - Full Control -Users - Read -ALL APPLICATION PACKAGES - ReadRun "Regedit". -Navigate to the following registry key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Right-click on "WinLogon" and select "Permissions…". -Select "Advanced". - -If the permissions are not as restrictive as the defaults listed below, this is a finding. - -The following are the same for each permission listed: -Type - Allow -Inherited from - MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion -Applies to - This key and subkeys - -Columns: Principal - Access -TrustedInstaller - Full Control -SYSTEM - Full Control -Administrators - Full Control -Users - Read -ALL APPLICATION PACKAGES - ReadRestrict Anonymous SAM Enumeration<GroupDescription></GroupDescription>WN12-SO-000051Anonymous enumeration of SAM accounts must not be allowed.<VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23082-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictAnonymousSAM - -Value Type: REG_DWORD -Value: 1Legal Banner Dialog Box Title<GroupDescription></GroupDescription>WN12-SO-000023The Windows dialog box title for the legal banner must be configured.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24020-0CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. - -If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LegalNoticeCaption - -Value Type: REG_SZ -Value: See message title options below - -"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. - -If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089. - -Automated tools may only search for the titles defined above. If a site-defined title is used, a manual review will be required.Access Credential Manager as a trusted caller<GroupDescription></GroupDescription>WN12-UR-000001The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25683-4CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding.Access this computer from the network<GroupDescription></GroupDescription>WN12-UR-000002-DCUnauthorized accounts must not have the Access this computer from the network user right on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Access this computer from the network" right may access resources on the system and should be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>If an application requires this user right, this can be downgraded to not a finding if the following conditions are met: -Vendor documentation must support the requirement for having the user right. -The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (V-36661) and required changes frequency (V-36662).</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Access this computer from the network" to only include the following accounts or groups: - -Administrators -Authenticated Users -Enterprise Domain ControllersVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Access this computer from the network" right, this is a finding: - -Administrators -Authenticated Users -Enterprise Domain ControllersAllow log on locally<GroupDescription></GroupDescription>WN12-UR-000005The Allow log on locally user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25228-8CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: - -Administrators - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Allow log on through Remote Desktop Services<GroupDescription></GroupDescription>WN12-UR-000006-DCThe Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding: - -AdministratorsBack up files and directories<GroupDescription></GroupDescription>WN12-UR-000007The Back up files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25380-7CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding: - -Administrators - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Create a pagefile<GroupDescription></GroupDescription>WN12-UR-000011The Create a pagefile user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23972-3CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: - -AdministratorsCreate a token object<GroupDescription></GroupDescription>WN12-UR-000012The Create a token object user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23939-2CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Create a token object" user right, this is a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Create global objects<GroupDescription></GroupDescription>WN12-UR-000013The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23850-1CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to only include the following accounts or groups: - -Administrators -Service -Local Service -Network ServiceVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding: - -Administrators -Service -Local Service -Network Service - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Create permanent shared objects<GroupDescription></GroupDescription>WN12-UR-000014The Create permanent shared objects user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23723-0CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding.Create symbolic links<GroupDescription></GroupDescription>WN12-UR-000015The Create symbolic links user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24549-8CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to only include the following accounts or groups: - -Administrators - -Systems that have the Hyper-V role will also have "Virtual Machines" given this user right. If this needs to be added manually, enter it as "NT Virtual Machine\Virtual Machines".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding: - -Administrators - -Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines"). This is not a finding.Deny log on as a batch job<GroupDescription></GroupDescription>WN12-UR-000018-DCThe Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. - -The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on as a batch job" to include the following: - -Guests GroupVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: - -Guests GroupDeny log on as service <GroupDescription></GroupDescription>WN12-UR-000019-DCThe Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on as a service" user right defines accounts that are denied log on as a service. - -Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on as a service" to include no entries (blank).Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If any accounts or groups are defined for the "Deny log on as a service" user right, this is a finding.Deny log on locally<GroupDescription></GroupDescription>WN12-UR-000020-DCThe Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on locally" to include the following: - -Guests GroupVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: - -Guests GroupDeny log on through Remote Desktop \ Terminal Services<GroupDescription></GroupDescription>WN12-UR-000021-DCThe Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on through Remote Desktop Services" to include the following: - -Guests GroupVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: - -Guests GroupEnable accounts to be trusted for delegation<GroupDescription></GroupDescription>WN12-UR-000022-DCUnauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Enable computer and user accounts to be trusted for delegation" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding: - -AdministratorsForce shutdown from a remote system<GroupDescription></GroupDescription>WN12-UR-000023The Force shutdown from a remote system user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24734-6CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: - -AdministratorsGenerate security audits<GroupDescription></GroupDescription>WN12-UR-000024The Generate security audits user right must only be assigned to Local Service and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24048-1CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Generate security audits" to only include the following accounts or groups: - -Local Service -Network ServiceVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding: - -Local Service -Network Service - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Impersonate a client after authentication<GroupDescription></GroupDescription>WN12-UR-000025The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24477-2CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to only include the following accounts or groups: - -Administrators -Service -Local Service -Network ServiceVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: - -Administrators -Service -Local Service -Network Service - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Increase scheduling priority<GroupDescription></GroupDescription>WN12-UR-000027The Increase scheduling priority user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24911-0CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Increase scheduling priority" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding: - -Administrators - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Load and unload device drivers<GroupDescription></GroupDescription>WN12-UR-000028The Load and unload device drivers user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24779-1CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: - -AdministratorsLock pages in memory<GroupDescription></GroupDescription>WN12-UR-000029The Lock pages in memory user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23829-5CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Manage auditing and security log<GroupDescription></GroupDescription>WN12-UR-000032The Manage auditing and security log user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23456-7CCI-000162CCI-000163CCI-000164CCI-000171CCI-001914Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding: - -Administrators - -If the organization has an Auditors group, the assignment of this group to the user right would not be a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Modify firmware environment values<GroupDescription></GroupDescription>WN12-UR-000034The Modify firmware environment values user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25533-1CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to only include the following accounts or groups: - -Administrators -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: - -AdministratorsPerform volume maintenance tasks<GroupDescription></GroupDescription>WN12-UR-000035The Perform volume maintenance tasks user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in data loss or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25070-4CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: - -AdministratorsProfile single process<GroupDescription></GroupDescription>WN12-UR-000036The Profile single process user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Profile single process" user right can monitor nonsystem processes performance. An attacker could potentially use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23844-4CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: - -AdministratorsRestore files and directories<GroupDescription></GroupDescription>WN12-UR-000040The Restore files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25518-2CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding: - -Administrators - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Take ownership of files or other objects<GroupDescription></GroupDescription>WN12-UR-000042The Take ownership of files or other objects user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25585-1CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: - -Administrators - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Audit - Credential Validation - Success<GroupDescription></GroupDescription>WN12-AU-000001The system must be configured to audit Account Logon - Credential Validation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Logon -> Credential Validation - SuccessAudit - Credential Validation - Failure<GroupDescription></GroupDescription>WN12-AU-000002The system must be configured to audit Account Logon - Credential Validation failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Logon -> Credential Validation - FailureAudit - Computer Account Management - Success<GroupDescription></GroupDescription>WN12-AU-000011-DCWindows Server 2012/2012 R2 domain controllers must be configured to audit Account Management - Computer Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Computer Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling computer accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Computer Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Management >> Computer Account Management - SuccessAudit - Other Account Management Events - Success<GroupDescription></GroupDescription>WN12-AU-000015The system must be configured to audit Account Management - Other Account Management Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Other Account Management Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Management -> Other Account Management Events - SuccessAudit - Security Group Management - Success<GroupDescription></GroupDescription>WN12-AU-000017The system must be configured to audit Account Management - Security Group Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Management -> Security Group Management - SuccessAudit - User Account Management - Success<GroupDescription></GroupDescription>WN12-AU-000019The system must be configured to audit Account Management - User Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Management -> User Account Management - SuccessAudit - User Account Management - Failure<GroupDescription></GroupDescription>WN12-AU-000020The system must be configured to audit Account Management - User Account Management failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Account Management -> User Account Management - FailureAudit - Process Creation - Success<GroupDescription></GroupDescription>WN12-AU-000023The system must be configured to audit Detailed Tracking - Process Creation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Process Creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Detailed Tracking -> Process Creation - SuccessAudit - Logoff - Success<GroupDescription></GroupDescription>WN12-AU-000045The system must be configured to audit Logon/Logoff - Logoff successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Logon/Logoff -> Logoff - SuccessAudit - Logon - Success<GroupDescription></GroupDescription>WN12-AU-000047The system must be configured to audit Logon/Logoff - Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Logon/Logoff -> Logon - SuccessAudit - Logon - Failure<GroupDescription></GroupDescription>WN12-AU-000048The system must be configured to audit Logon/Logoff - Logon failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Logon/Logoff -> Logon - FailureAudit - Special Logon - Success<GroupDescription></GroupDescription>WN12-AU-000053The system must be configured to audit Logon/Logoff - Special Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Logon/Logoff -> Special Logon - SuccessAudit - Audit Policy Change - Success<GroupDescription></GroupDescription>WN12-AU-000085The system must be configured to audit Policy Change - Audit Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Policy Change -> Audit Policy Change - SuccessAudit - Audit Policy Change - Failure<GroupDescription></GroupDescription>WN12-AU-000086The system must be configured to audit Policy Change - Audit Policy Change failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Policy Change -> Audit Policy Change - FailureAudit - Authentication Policy Change - Success<GroupDescription></GroupDescription>WN12-AU-000087The system must be configured to audit Policy Change - Authentication Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Policy Change -> Authentication Policy Change - SuccessAudit - Sensitive Privilege Use - Success<GroupDescription></GroupDescription>WN12-AU-000101The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Privilege Use -> Sensitive Privilege Use - SuccessAudit - Sensitive Privilege Use - Failure<GroupDescription></GroupDescription>WN12-AU-000102The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Privilege Use -> Sensitive Privilege Use - FailureAudit - IPSec Driver - Success<GroupDescription></GroupDescription>WN12-AU-000103The system must be configured to audit System - IPsec Driver successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -IPsec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -System -> IPsec Driver - SuccessAudit - IPSec Driver - Failure<GroupDescription></GroupDescription>WN12-AU-000104The system must be configured to audit System - IPsec Driver failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -IPsec Driver records events related to the IPsec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -System -> IPsec Driver - FailureAudit - Security State Change - Success<GroupDescription></GroupDescription>WN12-AU-000107The system must be configured to audit System - Security State Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -System -> Security State Change - SuccessAudit - Security System Extension - Success<GroupDescription></GroupDescription>WN12-AU-000109The system must be configured to audit System - Security System Extension successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -System -> Security System Extension - SuccessAudit - System Integrity - Success<GroupDescription></GroupDescription>WN12-AU-000111The system must be configured to audit System - System Integrity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -System -> System Integrity - SuccessAudit - System Integrity - Failure<GroupDescription></GroupDescription>WN12-AU-000112The system must be configured to audit System - System Integrity failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -System -> System Integrity - Failure6to4 State<GroupDescription></GroupDescription>WN12-CC-000007The 6to4 IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24732-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set 6to4 State" to "Enabled: Disabled State".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ - -Value Name: 6to4_State - -Type: REG_SZ -Value: DisabledIP-HTTPS State<GroupDescription></GroupDescription>WN12-CC-000008The IP-HTTPS IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25651-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set IP-HTTPS State" to "Enabled: Disabled State". - -Note: "IPHTTPS URL:" must be entered in the policy even if set to Disabled State. Enter "about:blank".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface\ - -Value Name: IPHTTPS_ClientState - -Type: REG_DWORD -Value: 3ISATAP State<GroupDescription></GroupDescription>WN12-CC-000009The ISATAP IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25249-4CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set ISATAP State" to "Enabled: Disabled State".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ - -Value Name: ISATAP_State - -Type: REG_SZ -Value: DisabledTeredo State<GroupDescription></GroupDescription>WN12-CC-000010The Teredo IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25571-1CCI-000382Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set Teredo State" to "Enabled: Disabled State".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ - -Value Name: Teredo_State - -Type: REG_SZ -Value: DisabledMaximum Log Size - Application<GroupDescription></GroupDescription>WN12-CC-000084The Application event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24277-6CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)Maximum Log Size - Security<GroupDescription></GroupDescription>WN12-CC-000085The Security event log size must be configured to 196608 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24572-0CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "196608" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00030000 (196608) (or greater)Maximum Log Size - Setup<GroupDescription></GroupDescription>WN12-CC-000086The Setup event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23743-8CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Setup >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)Maximum Log Size - System<GroupDescription></GroupDescription>WN12-CC-000087The System event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24411-1CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)Fax Service Disabled <GroupDescription></GroupDescription>WN12-SV-000100The Fax service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25383-1CCI-000381Remove or disable the Fax (fax) service.Verify the Fax (fax) service is not installed or is disabled. - -Run "Services.msc". - -If the following is installed and not disabled, this is a finding: - -Fax (fax)Microsoft FTP Service Disabled<GroupDescription></GroupDescription>WN12-SV-000101The Microsoft FTP service must not be installed unless required.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23863-4CCI-000382Remove or disable the "Microsoft FTP Service" (Service name: FTPSVC). - -To remove the "FTP Server" role from a system: -Start "Server Manager" -Select the server with the "FTP Server" role. -Scroll down to "ROLES AND FEATURES" in the left pane. -Select "Remove Roles and Features" from the drop down "TASKS" list. -Select the appropriate server on the "Server Selection" page, click "Next". -De-select "FTP Server" under "Web Server (IIS). -Click "Next" and "Remove" as prompted.If the server has the role of an FTP server, this is NA. - -Run "Services.msc". - -If the "Microsoft FTP Service" (Service name: FTPSVC) is installed and not disabled, this is a finding.Peer Networking Identity Manager Service Disabled<GroupDescription></GroupDescription>WN12-SV-000103The Peer Networking Identity Manager service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24910-2CCI-000381Remove or disable the Peer Networking Identity Manager (p2pimsvc) service.Verify the Peer Network Identity Manager (p2pimsvc) service is not installed or is disabled. - -Run "Services.msc". - -If the following is installed and not disabled, this is a finding: - -Peer Networking Identity Manager (p2pimsvc)Simple TCP/IP Services Disabled<GroupDescription></GroupDescription>WN12-SV-000104The Simple TCP/IP Services service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23748-7CCI-000381Remove or disable the Simple TCP/IP Services (simptcp) service.Verify the Simple TCP/IP (simptcp) service is not installed or is disabled. - -Run "Services.msc". - -If the following is installed and not disabled, this is a finding: - -Simple TCP/IP Services (simptcp)Telnet Service Disabled<GroupDescription></GroupDescription>WN12-SV-000105The Telnet service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24474-9CCI-000382Remove or disable the Telnet (tlntsvr) service.Verify the Telnet (tlntsvr) service is not installed or is disabled. - -Run "Services.msc". - -If the following is installed and not disabled, this is a finding: - -Telnet (tlntsvr)Directory PKI Certificate Source - Users<GroupDescription></GroupDescription>WN12-PK-000007-DCPKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA).<VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000185Map user accounts to PKI certificates using the appropriate User Principal Name (UPN) for the network. See PKE documentation for details.Open "PowerShell" as Administrator. - -Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled -AutoSize". - -Review the User Principal Name (UPN) of user accounts, including administrators. - -Exclude the built-in accounts such as Administrator and Guest. - -If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding. - -For standard NIPRNET certificates the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI). - -Alt Tokens and other certificates may use a different UPN format than the EDI-PI, which vary by organization. Verify these with the organization. - -NIPRNET Example: -Name - User Principal Name -User1 - 1234567890@mil - -See PKE documentation for other network domain suffixes. - -If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.Device Install Software Request Error Report<GroupDescription></GroupDescription>WN12-CC-000023Windows must be prevented from sending an error report when a device driver requests additional software during installation.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent Windows from sending an error report to Microsoft when a device driver requests additional software during installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24685-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent Windows from sending an error report when a device driver requests additional software during installation" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ - -Value Name: DisableSendRequestAdditionalSoftwareToWER - -Type: REG_DWORD -Value: 1Add workstations to domain<GroupDescription></GroupDescription>WN12-UR-000044-DCUnauthorized accounts must not have the Add workstations to domain user right.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Add workstations to domain" right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23271-0CCI-002235Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Add workstations to domain" to only include the following accounts or groups: - -AdministratorsVerify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Add workstations to domain" right, this is a finding: - -AdministratorsWINPK-000001<GroupDescription></GroupDescription>WN12-PK-000001The DoD Root CA certificates must be installed in the Trusted Root Store.<VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000185CCI-002470Install the DoD Root CA certificates. -DoD Root CA 2 -DoD Root CA 3 -DoD Root CA 4 -DoD Root CA 5 - -The InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities. - -The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter - -If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 -NotAfter: 12/5/2029 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB -NotAfter: 12/30/2029 - -Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 -NotAfter: 7/25/2032 - -Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -NotAfter: 6/14/2041 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". - -For each of the DoD Root CA certificates noted below: - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -DoD Root CA 2 -Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 -Valid to: Wednesday, December 5, 2029 - -DoD Root CA 3 -Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB -Valid to: Sunday, December 30, 2029 - -DoD Root CA 4 -Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 -Valid to: Sunday, July 25, 2032 - -DoD Root CA 5 -Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -Valid to: Friday, June 14, 2041WINPK-000003<GroupDescription></GroupDescription>WN12-PK-000003The DoD Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000185CCI-002470Install the DoD Interoperability Root CA cross-certificates on unclassified systems. - -Issued To - Issued By - Thumbprint -DoD Root CA 2 - DoD Interoperability Root CA 1 - 22BBE981F0694D246CC1472ED2B021DC8540A22F -DoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341 - -The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -NotAfter: 9/6/2019 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -NotAfter: 1/22/2022 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -Issued To: DoD Root CA 2 -Issued By: DoD Interoperability Root CA 1 -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -Valid to: Friday, September 6, 2019 - -Issued To: DoD Root CA 3 -Issued By: DoD Interoperability Root CA 2 -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -Valid to: Saturday, January 22, 2022WINRG-000001 Active Setup\Installed Components Registry Permissions<GroupDescription></GroupDescription>WN12-RG-000002Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.<VulnDiscussion>Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Maintain the default permissions of the following registry keys: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ -HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only) - -Users - Read -Administrators - Full Control -SYSTEM - Full Control -CREATOR OWNER - Full Control (Subkeys only) -ALL APPLICATION PACKAGES - ReadRun "Regedit". -Navigate to the following registry keys and review the permissions: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ -HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems) - -If the default permissions listed below have been changed, this is a finding. - -Users - Read -Administrators - Full Control -SYSTEM - Full Control -CREATOR OWNER - Full Control (Subkeys only) -ALL APPLICATION PACKAGES - ReadAudit Directory Service Access - Success<GroupDescription></GroupDescription>WN12-AU-000031-DCThe system must be configured to audit DS Access - Directory Service Access successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit directory service access records events related to users accessing an Active Directory object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Access" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the Auditpol settings with the following. If the system does not audit the following, this is a finding. - -DS Access -> Directory Service Access - SuccessAudit - Directory Service Access - Failure<GroupDescription></GroupDescription>WN12-AU-000032-DCThe system must be configured to audit DS Access - Directory Service Access failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit directory service access records events related to users accessing an Active Directory object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Access" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the Auditpol settings with the following. If the system does not audit the following, this is a finding. - -DS Access -> Directory Service Access - FailureAudit - Directory Service Changes - Success<GroupDescription></GroupDescription>WN12-AU-000035-DCThe system must be configured to audit DS Access - Directory Service Changes successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit directory service changes records events related to changes made to objects in Active Directory Domain Services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Changes" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the Auditpol settings with the following. If the system does not audit the following, this is a finding. - -DS Access -> Directory Service Changes - SuccessAudit - Directory Service Changes - Failure<GroupDescription></GroupDescription>WN12-AU-000036-DCThe system must be configured to audit DS Access - Directory Service Changes failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detecting attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit directory service changes records events related to changes made to objects in Active Directory Domain Services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Detailed auditing subcategories are configured in Security Settings -> Advanced Audit Policy Configuration. The summary level settings under Security Settings -> Local Policies -> Audit Policy will not be enforced (see V-14230). - -Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> DS Access -> "Directory Service Changes" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the Auditpol settings with the following. If the system does not audit the following, this is a finding. - -DS Access -> Directory Service Changes - FailureGroup Policy Objects Access Control<GroupDescription></GroupDescription>WN12-AD-000003-DCActive Directory Group Policy objects must have proper access control permissions.<VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems relying on the directory service. - -For Active Directory (AD), the Group Policy objects require special attention. In a distributed administration model (i.e., help desk), Group Policy objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for Group Policy Objects, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Ensure the permissions on Group Policy objects do not allow greater than Read and Apply group policy for standard user accounts or groups. The default permissions below meet this requirement. - -Authenticated Users - Read, Apply group policy, Special permissions -The Special permissions for Authenticated Users are for Read type Properties. - -CREATOR OWNER - Special permissions - -SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions - -Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions - -Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -Document any other access permissions that allow the objects to be updated with the ISSO. - -The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default group policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on created group policy objects.Verify the permissions on Group Policy objects. - -Open "Group Policy Management". (Available from various menus or run "gpmc.msc".) -Navigate to "Group Policy Objects" in the domain being reviewed (Forest > Domains > Domain). - -For each Group Policy object: -Select the Group Policy object item in the left pane. -Select the Delegation tab in the right pane. -Select the Advanced button. - -If any standard user accounts or groups have greater than Allow permissions of Read and Apply group policy, this is a finding. - -Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO. - -The default permissions noted below meet this requirement. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next Advanced button, selecting the desired Permission entry, and the Edit button. - -Authenticated Users - Read, Apply group policy, Special permissions - -The Special permissions for Authenticated Users are for Read type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -The Special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties. - -CREATOR OWNER - Special permissions - -SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions - -Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions - -Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default group policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on created group policy objects. - -The Anonymous Logon, Guests, or any group that contains those groups (in which users are not uniquely identified and authenticated) must not have any access permissions unless the group and justification is explicitly documented with the ISSO.Always Install with Elevated Privileges Disabled<GroupDescription></GroupDescription>WN12-CC-000116The Windows Installer Always install with elevated privileges option must be disabled.<VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23919-4CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Always install with elevated privileges" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Installer\ - -Value Name: AlwaysInstallElevated - -Type: REG_DWORD -Value: 0Accounts with administrative privileges Internet access<GroupDescription></GroupDescription>WN12-00-000008Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.<VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. - -Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email. - -The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Implement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. - -The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. - -If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.WINUC-000001<GroupDescription></GroupDescription>WN12-UC-000001A screen saver must be enabled on the system.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24055-6CCI-000060Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Enable screen saver" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ - -Value Name: ScreenSaveActive - -Type: REG_SZ -Value: 1 - -Applications requiring continuous, real-time screen display (e.g., network management products) require the following and must be documented with the ISSO: - --The logon session does not have administrator rights. --The display station (e.g., keyboard, monitor, etc.) is located in a controlled access area.WINUC-000003<GroupDescription></GroupDescription>WN12-UC-000003The screen saver must be password protected.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>PESL-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24680-1CCI-000056Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Password protect the screen saver" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ - -Value Name: ScreenSaverIsSecure - -Type: REG_SZ -Value: 1WIN00-000005-01<GroupDescription></GroupDescription>WN12-00-000004Users with administrative privilege must be documented.<VulnDiscussion>Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those with this level of access are clearly identified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Create the necessary documentation that identifies the members of the Administrators group.Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding.WIN00-000005-02<GroupDescription></GroupDescription>WN12-00-000005Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.<VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. - -If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.WIN00-000010-01<GroupDescription></GroupDescription>WN12-00-000010Policy must require application account passwords be at least 15 characters in length.<VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000205Establish a site policy that requires application/service account passwords that are manually managed to be at least 15 characters in length. Ensure the policy is enforced.Verify the site has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. If such a policy does not exist or has not been implemented, this is a finding.WIN00-000010-02<GroupDescription></GroupDescription>WN12-00-000011Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.<VulnDiscussion>Setting application accounts to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. - -It is recommended that system-managed service accounts be used where possible.Determine if manually managed application/service accounts exist. If none exist, this is NA. - -If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. - -Identify manually managed application/service accounts. - -To determine the date a password was last changed: - -Domain controllers: - -Open "Windows PowerShell". - -Enter "Get-ADUser -Identity [application account name] -Properties PasswordLastSet | FL Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. - -If the "PasswordLastSet" date is more than one year old, this is a finding. - -Member servers and standalone systems: - -Open "Windows PowerShell" or "Command Prompt". - -Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. - -If the "Password Last Set" date is more than one year old, this is a finding.WIN00-000014<GroupDescription></GroupDescription>WN12-00-000006Policy must require that system administrators (SAs) be trained for the operating systems used by systems under their control.<VulnDiscussion>If SAs are assigned to systems running operating systems for which they have no training, these systems are at additional risk of unintentional misconfiguration that may result in vulnerabilities or decreased availability of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Establish site policy that requires SAs be trained for all operating systems running on systems under their control.Determine whether the site has a policy that requires SAs be trained for all operating systems running on systems under their control. If the site does not have a policy requiring SAs be trained for all operating systems under their control, this is a finding.WINAU-000016<GroupDescription></GroupDescription>WN12-AU-000082The system must be configured to audit Object Access - Removable Storage failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Object Access >> Removable Storage - Failure - -Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.WINAU-000017<GroupDescription></GroupDescription>WN12-AU-000081The system must be configured to audit Object Access - Removable Storage successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Object Access >> Removable Storage - Success - -Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.WINAU-000100<GroupDescription></GroupDescription>WN12-AU-000200Audit data must be reviewed on a regular basis.<VulnDiscussion>To be of value, audit logs from critical systems must be reviewed on a regular basis. Critical systems should be reviewed on a daily basis to identify security breaches and potential weaknesses in the security structure. This can be done with the use of monitoring software or other utilities for this purpose.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAT-1, ECAT-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Review audit logs on a predetermined scheduled.Determine whether audit logs are reviewed on a predetermined schedule. If audit logs are not reviewed on a regular basis, this is a finding.WINAU-000101<GroupDescription></GroupDescription>WN12-AU-000201Audit data must be retained for at least one year.<VulnDiscussion>Audit records are essential for investigating system activity after the fact. Retention periods for audit data are determined based on the sensitivity of the data handled by the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECRR-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure the audit data is retained for at least a year.Determine whether audit data is retained for at least one year. If the audit data is not retained for at least a year, this is a finding.WINAU-000102<GroupDescription></GroupDescription>WN12-AU-000203-01Audit records must be backed up onto a different system or media than the system being audited.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001851Establish and implement a process for backing up log data to another system or media other than the system being audited.Determine if a process to back up log data to a different system or media than the system being audited has been implemented. If it has not, this is a finding.WINCC-000011<GroupDescription></GroupDescription>WN12-CC-000011IP stateless autoconfiguration limits state must be enabled.<VulnDiscussion>IP stateless autoconfiguration could configure routes that circumvent preferred routes if not limited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24070-5CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> Parameters -> "Set IP Stateless Autoconfiguration Limits State" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: EnableIPAutoConfigurationLimits - -Type: REG_DWORD -Value: 1WINCC-000018<GroupDescription></GroupDescription>WN12-CC-000018Optional component installation and component repair must be prevented from using Windows Update.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Optional component installation or repair must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23727-1CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> "Specify settings for optional component installation and component repair" to "Enabled" and with "Never attempt to download payload from Windows Update" selected.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Servicing\ - -Value Name: UseWindowsUpdate - -Type: REG_DWORD -Value: 2WINCC-000025<GroupDescription></GroupDescription>WN12-CC-000025Device driver updates must only search managed servers, not Windows Update.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Device driver updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25002-7CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify the search server for device driver updates" to "Enabled" with "Search Managed Server" selected.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ - -Value Name: DriverServerSelection - -Type: REG_DWORD -Value: 1WINCC-000027<GroupDescription></GroupDescription>WN12-CC-000027Early Launch Antimalware, Boot-Start Driver Initialization Policy must be enabled and configured to only Good and Unknown.<VulnDiscussion>Compromised boot drivers can introduce malware prior to some protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECVP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25320-3CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Early Launch Antimalware -> "Boot-Start Driver Initialization Policy" to "Enabled" with "Good and Unknown" selected.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Policies\EarlyLaunch\ - -Value Name: DriverLoadPolicy - -Type: REG_DWORD -Value: 1WINCC-000030<GroupDescription></GroupDescription>WN12-CC-000030Access to the Windows Store must be turned off.<VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24981-3CCI-000366If the \Windows\WinStore directory exists, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off access to the Store" to "Enabled". - -Alternately, uninstall the "Desktop Experience" feature from Windows 2012. This is located under "User Interfaces and Infrastructure" in the "Add Roles and Features Wizard". The \Windows\WinStore directory may need to be manually deleted after this.The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoUseStoreOpenWith - -Type: REG_DWORD -Value: 1WINCC-000048<GroupDescription></GroupDescription>WN12-CC-000048Copying of user input methods to the system account for sign-in must be prevented.<VulnDiscussion>Allowing different input methods for sign-in could open different avenues of attack. User input methods must be restricted to those enabled for the system account at sign-in.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24401-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Locale Services -> "Disallow copying of user input methods to the system account for sign-in" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Control Panel\International\ - -Value Name: BlockUserInputMethodsForSignIn - -Type: REG_DWORD -Value: 1WINCC-000051<GroupDescription></GroupDescription>WN12-CC-000051Local users on domain-joined computers must not be enumerated.<VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23305-6CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Enumerate local users on domain-joined computers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\System\ - -Value Name: EnumerateLocalUsers - -Type: REG_DWORD -Value: 0WINCC-000052<GroupDescription></GroupDescription>WN12-CC-000052App notifications on the lock screen must be turned off.<VulnDiscussion>App notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24092-9CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Turn off app notifications on the lock screen" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\System\ - -Value Name: DisableLockScreenAppNotifications - -Type: REG_DWORD -Value: 1WINCC-000065<GroupDescription></GroupDescription>WN12-CC-000065The detection of compatibility issues for applications and drivers must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24560-5CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Application Compatibility Diagnostics -> "Detect compatibility issues for applications and drivers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\AppCompat\ - -Value Name: DisablePcaUI - -Type: REG_DWORD -Value: 0WINCC-000070<GroupDescription></GroupDescription>WN12-CC-000070Trusted app installation must be enabled to allow for signed enterprise line of business apps.<VulnDiscussion>Enabling trusted app installation allows for enterprise line of business Windows 8 type apps. A trusted app package is one that is signed with a certificate chain that can be successfully validated in the enterprise. Configuring this ensures enterprise line of business apps are accessible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23960-8CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> App Package Deployment -> "Allow all trusted apps to install" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\Appx\ - -Value Name: AllowAllTrustedApps - -Type: REG_DWORD -Value: 1WINCC-000075<GroupDescription></GroupDescription>WN12-CC-000075The use of biometrics must be disabled.<VulnDiscussion>Allowing biometrics may bypass required authentication methods. Biometrics may only be used as an additional authentication factor where an enhanced strength of identity credential is necessary or desirable. Additional factors must be met per DoD policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24801-3CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Biometrics -> "Allow the use of biometrics" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Biometrics\ - -Value Name: Enabled - -Type: REG_DWORD -Value: 0WINCC-000076<GroupDescription></GroupDescription>WN12-CC-000076The password reveal button must not be displayed.<VulnDiscussion>Visible passwords may be seen by nearby persons, compromising them. The password reveal button can be used to display an entered password and must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23228-0CCI-000206Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Credential User Interface -> "Do not display the password reveal button" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\CredUI\ - -Value Name: DisablePasswordReveal - -Type: REG_DWORD -Value: 1WINCC-000088<GroupDescription></GroupDescription>WN12-CC-000088Windows SmartScreen must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23531-7CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with either "Give user a warning before running downloaded unknown software" or "Require approval from an administrator before running downloaded unknown software" selected. - -Microsoft has changed this setting several times in the Windows 10 administrative templates, which will affect group policies in a domain if later templates are used. - -v1607 of Windows 10 and Windows Server 2016 changed the setting to only Enabled or Disabled without additional selections. Enabled is effectively "Give user a warning…". - -v1703 of Windows 10 or later administrative templates changed the policy name to "Configure Windows Defender SmartScreen", and the selectable options are "Warn" and "Warn and prevent bypass". When either of these are applied to a Windows 2012/2012 R2 system, it will configure the registry equivalent of "Give user a warning…").This is applicable to unclassified systems; for other systems, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnableSmartScreen - -Type: REG_DWORD -Value: 0x00000001 (1) (Give user a warning…) -Or 0x00000002 (2) (Require approval…)WINCC-000095<GroupDescription></GroupDescription>WN12-CC-000095The location feature must be turned off.<VulnDiscussion>The location service on systems may allow sensitive data to be used by applications on the system. This should be turned off unless explicitly allowed for approved systems/applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25343-5CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Location and Sensors -> "Turn off location" to "Enabled". - -If location services are approved by the organization for a device, this must be documented.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LocationAndSensors\ - -Value Name: DisableLocation - -Type: REG_DWORD -Value: 1 (Enabled) - -If location services are approved for the system by the organization, this may be set to "Disabled" (0). This must be documented with the ISSO.WINCC-000106<GroupDescription></GroupDescription>WN12-CC-000106Basic authentication for RSS feeds over HTTP must be turned off.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23213-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds -> "Turn on Basic feed authentication over HTTP" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Internet Explorer\Feeds\ - -Value Name: AllowBasicAuthInClear - -Type: REG_DWORD -Value: 0WINCC-000109<GroupDescription></GroupDescription>WN12-CC-000109Automatic download of updates from the Windows Store must be turned off.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially allow sensitive information outside of the enterprise. Application updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. - -Windows 2012 R2: -Windows 2012 R2 split the original policy that configures this setting into two separate ones. Configuring either one to "Enabled" will update the registry value as identified in the Check section. - -Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> -"Turn off Automatic Download of updates on Win8 machines" or "Turn off Automatic Download and install of updates" to "Enabled". - -Windows 2012: -Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> "Turn off Automatic Download of updates" to "Enabled".The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. -If the following registry value does not exist or is not configured as specified, this is a finding: - -Windows 2012 R2: -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ - -Value Name: AutoDownload - -Type: REG_DWORD -Value: 0x00000002 (2) - -Windows 2012: -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\WindowsUpdate\ - -Value Name: AutoDownload - -Type: REG_DWORD -Value: 0x00000002 (2)WINCC-000110<GroupDescription></GroupDescription>WN12-CC-000110The Windows Store application must be turned off.<VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and provide access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. - -Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> "Turn off the Store application" to "Enabled".The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ - -Value Name: RemoveWindowsStore - -Type: REG_DWORD -Value: 1WINCC-000123<GroupDescription></GroupDescription>WN12-CC-000123The Windows Remote Management (WinRM) client must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24431-9CCI-000877Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowBasic - -Type: REG_DWORD -Value: 0WINCC-000124<GroupDescription></GroupDescription>WN12-CC-000124The Windows Remote Management (WinRM) client must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23728-9CCI-002890CCI-003123Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowUnencryptedTraffic - -Type: REG_DWORD -Value: 0WINCC-000125<GroupDescription></GroupDescription>WN12-CC-000125The Windows Remote Management (WinRM) client must not use Digest authentication.<VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25263-5CCI-000877Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Disallow Digest authentication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowDigest - -Type: REG_DWORD -Value: 0WINCC-000126<GroupDescription></GroupDescription>WN12-CC-000126The Windows Remote Management (WinRM) service must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23637-2CCI-000877Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: AllowBasic - -Type: REG_DWORD -Value: 0WINCC-000127<GroupDescription></GroupDescription>WN12-CC-000127The Windows Remote Management (WinRM) service must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25102-5CCI-002890CCI-003123Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: AllowUnencryptedTraffic - -Type: REG_DWORD -Value: 0WINCC-000128<GroupDescription></GroupDescription>WN12-CC-000128The Windows Remote Management (WinRM) service must not store RunAs credentials.<VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23262-9CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Disallow WinRM from storing RunAs credentials" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: DisableRunAs - -Type: REG_DWORD -Value: 1WINAU-000204<GroupDescription></GroupDescription>WN12-AU-000204Permissions for the Application event log must prevent access by nonprivileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000162CCI-000163CCI-000164Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having greater than Read access. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have greater than Read access. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. - -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.WINAU-000205<GroupDescription></GroupDescription>WN12-AU-000205Permissions for the Security event log must prevent access by nonprivileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000162CCI-000163CCI-000164Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. - -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.WINAU-000206<GroupDescription></GroupDescription>WN12-AU-000206Permissions for the System event log must prevent access by nonprivileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000162CCI-000163CCI-000164Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having greater than Read access. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have greater than Read access. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. - -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.WINGE-000027<GroupDescription></GroupDescription>WN12-00-000015User-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. - -User-level information is data generated by information system and/or application users. - -Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement user-level information backups in accordance with local recovery time and recovery point objectives.Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.WINGE-000028<GroupDescription></GroupDescription>WN12-GE-000023Windows Server 2012 / 2012 R2 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001233Install a DoD approved HBSS software and ensure it is operating continuously.Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. - -If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.WINGE-000029<GroupDescription></GroupDescription>WN12-GE-000024The system must support automated patch management tools to facilitate flaw remediation.<VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Establish a process to automatically install security-related software updates.Verify the organization has an automated process to install security-related software updates. If it does not, this is a finding.WINGE-000030<GroupDescription></GroupDescription>WN12-GE-000025The system must query the certification authority to determine whether a public key certificate has been revoked before accepting the certificate for authentication purposes.<VulnDiscussion>Failure to verify a certificate's revocation status can result in the system accepting a revoked, and therefore unauthorized, certificate. This could result in the installation of unauthorized software or a connection for rogue networks, depending on the use for which the certificate is intended. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install software that provides certificate validation and revocation checking.Verify the system has software installed and running that provides certificate validation and revocation checking. If it does not, this is a finding.WINSO-000021<GroupDescription></GroupDescription>WN12-SO-000021The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23043-3CCI-000057Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: InactivityTimeoutSecs - -Value Type: REG_DWORD -Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled)WINUC-000005<GroupDescription></GroupDescription>WN12-UC-000005Notifications from Windows Push Network Service must be turned off.<VulnDiscussion>The Windows Push Notification Service (WNS) allows third-party vendors to send updates for toasts, tiles, and badges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25048-0CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Notifications -> "Turn off notifications network usage" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\ - -Value Name: NoCloudApplicationNotification - -Type: REG_DWORD -Value: 1WINUC-000006<GroupDescription></GroupDescription>WN12-UC-000006Toast notifications to the lock screen must be turned off.<VulnDiscussion>Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25414-4CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Notifications -> "Turn off toast notifications on the lock screen" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\ - -Value Name: NoToastApplicationNotificationOnLockScreen - -Type: REG_DWORD -Value: 1WINAU-000207-DC<GroupDescription></GroupDescription>WN12-AU-000207-DCActive Directory Group Policy objects must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes Group Policy objects. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the audit settings for Group Policy objects to include the following. - -This can be done at the Policy level in Active Directory to apply to all group policies. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Select "Advanced Features" from the "View" Menu. - -Navigate to [Domain] >> System >> Policies in the left panel. - -Right click "Policies", select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button. - -Select the "Auditing" tab. - -Type - Fail -Principal - Everyone -Access - Full Control -Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects - -The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. - -Type - Success -Principal - Everyone -Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) -Inherited from - Parent Object -Applies to - Descendant groupPolicyContainer objects - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) -Inherited from - Parent Object -Applies to - Descendant Organization Unit ObjectsReview the auditing configuration for all Group Policy objects. - -Open "Group Policy Management". (Available from various menus, or run "gpmc.msc".) - -Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). - -For each Group Policy object: - -Select the Group Policy Object item in the left pane. - -Select the "Delegation" tab in the right pane. - -Select the "Advanced" button. - -Select the "Advanced" button again and then the "Auditing" tab. - -If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects - -The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. - -Type - Success -Principal - Everyone -Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) -Inherited from - Parent Object -Applies to - Descendant groupPolicyContainer objects - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) -Inherited from - Parent Object -Applies to - Descendant Organization Unit ObjectsWINAU-000208-DC<GroupDescription></GroupDescription>WN12-AU-000208-DCThe Active Directory Domain object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the audit settings for Domain object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special - -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner.)Verify the auditing configuration for the Domain object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the domain being reviewed in the left pane. -Right click the domain name and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special - -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner)WINAU-000209-DC<GroupDescription></GroupDescription>WN12-AU-000209-DCThe Active Directory Infrastructure object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the audit settings for Infrastructure object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)Verify the auditing configuration for Infrastructure object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the domain being reviewed in the left pane. -Right click the Infrastructure object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)WINAU-000210-DC<GroupDescription></GroupDescription>WN12-AU-000210-DCThe Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the audit settings for Domain Controllers OU object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsVerify the auditing configuration for the Domain Controller OU object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the Domain Controllers OU under the domain being reviewed in the left pane. -Right click the Domain Controllers OU object and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object and all descendant objects - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsWINAU-000211-DC<GroupDescription></GroupDescription>WN12-AU-000211-DCThe Active Directory AdminSDHolder object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the audit settings for AdminSDHolder object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsVerify the auditing configuration for the AdminSDHolder object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select System under the domain being reviewed in the left pane. -Right click the AdminSDHolder object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the AdminSDHolder object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsWINAU-000212-DC<GroupDescription></GroupDescription>WN12-AU-000212-DCThe Active Directory RID Manager$ object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the audit settings for RID Manager$ object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)Verify the auditing configuration for the RID Manager$ object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select System under the domain being reviewed in the left pane. -Right-click the RID Manager$ object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the RID Manager$ object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)WINAD-000002-DC<GroupDescription></GroupDescription>WN12-AD-000002-DCThe Active Directory SYSVOL directory must have the proper access control permissions.<VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. - -The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECCD-1, ECCD-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Ensure the permissions on SYSVOL directory do not allow greater than read & execute for standard user accounts or groups. The defaults below meet this requirement. - -Type - Allow -Principal - Authenticated Users -Access - Read & execute -Inherited from - None -Applies to - This folder, subfolder and files - -Type - Allow -Principal - Server Operators -Access - Read & execute -Inherited from - None -Applies to - This folder, subfolder and files - -Type - Allow -Principal - Administrators -Access - Special -Inherited from - None -Applies to - This folder only -(Access - Special - Basic Permissions: all selected except Full control) - -Type - Allow -Principal - CREATOR OWNER -Access - Full control -Inherited from - None -Applies to - Subfolders and files only - -Type - Allow -Principal - Administrators -Access - Full control -Inherited from - None -Applies to - Subfolders and files only - -Type - Allow -Principal - SYSTEM -Access - Full control -Inherited from - None -Applies to - This folder, subfolders and filesVerify the permissions on the SYSVOL directory. - -Open a command prompt. -Run "net share". -Make note of the directory location of the SYSVOL share. - -By default this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. - -Open File Explorer. -Navigate to \Windows\SYSVOL (or the directory noted previously if different). -Right click the directory and select properties. -Select the Security tab. -Click Advanced. - -If any standard user accounts or groups have greater than read & execute permissions, this is a finding. The default permissions noted below meet this requirement. - -Type - Allow -Principal - Authenticated Users -Access - Read & execute -Inherited from - None -Applies to - This folder, subfolder and files - -Type - Allow -Principal - Server Operators -Access - Read & execute -Inherited from - None -Applies to - This folder, subfolder and files - -Type - Allow -Principal - Administrators -Access - Special -Inherited from - None -Applies to - This folder only -(Access - Special - Basic Permissions: all selected except Full control) - -Type - Allow -Principal - CREATOR OWNER -Access - Full control -Inherited from - None -Applies to - Subfolders and files only - -Type - Allow -Principal - Administrators -Access - Full control -Inherited from - None -Applies to - Subfolders and files only - -Type - Allow -Principal - SYSTEM -Access - Full control -Inherited from - None -Applies to - This folder, subfolders and files - - -Alternately, use Icacls.exe to view the permissions of the SYSVOL directory. -Open a command prompt. -Run "icacls c:\Windows\SYSVOL -The following results should be displayed: - -NT AUTHORITY\Authenticated Users:(RX) -NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) -BUILTIN\Server Operators:(RX) -BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) -BUILTIN\Administrators:(M,WDAC,WO) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(F) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M,WDAC,WO) -CREATOR OWNER:(OI)(CI)(IO)(F) - -(RX) - Read & execute -Run "icacls /help" to view definitions of other permission codes.WINAD-000004-DC<GroupDescription></GroupDescription>WN12-AD-000004-DCThe Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.<VulnDiscussion>When Active Directory (AD) objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes which could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Limit the permissions on the Domain Controllers OU to restrict changes to System, Domain Admins, Enterprise Admins and Administrators. - -The default permissions listed below satisfy this requirement. - -Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions. - -SELF - Special permissions - -Authenticated Users - Read, Special permissions -The Special permissions for Authenticated Users are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Enterprise Admins - Full Control - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions -The Special permissions for Pre-Windows 2000 Compatible Access are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsVerify the permissions on the Domain Controllers OU. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) - -Select Advanced Features in the View menu if not previously selected. - -Navigate to the Domain Controllers OU (folder in folder icon). - -Right click the OU and select Properties. - -Select the Security tab. - -If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. - -The default permissions listed below satisfy this requirement. - -Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired Permission entry, and the Edit button. - -SELF - Special permissions - -Authenticated Users - Read, Special permissions -The Special permissions for Authenticated Users are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Enterprise Admins - Full Control - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions -The Special permissions for Pre-Windows 2000 Compatible Access are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsWINAD-000005-DC<GroupDescription></GroupDescription>WN12-AD-000005-DCDomain created Active Directory Organizational Unit (OU) objects must have proper access control permissions.<VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -For Active Directory (AD), the Organizational Unit (OU) objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a Denial of Service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is Category I (e.g., OUs that include user accounts, including service/application accounts). - -If the OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is Category II (e.g., Workstation, Printer OUs).</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Ensure the permissions on domain defined OUs are at least as restrictive as the defaults below. - -Document any additional permissions above read with the ISSO if an approved distributed administration model (help desk or other user support staff) is implemented. - -Self - Special permissions - -Authenticated Users - Read, Special permissions -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsVerifying the permissions on domain defined OUs. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. - -For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: -Right click the OU and select Properties. -Select the Security tab. - -If the permissions on the OU are not at least as restrictive as those below, this is a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next Advanced button, selecting the desired Permission entry and the Edit button. - -Self - Special permissions - -Authenticated Users - Read, Special permissions -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO.WINPK-000005-DC<GroupDescription></GroupDescription>WN12-PK-000005-DCDomain controllers must have a PKI server certificate.<VulnDiscussion>Domain controller must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IATS-1, IATS-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000185Obtain a server certificate for the domain controller.Verify the domain controller has a PKI server certificate. - -Run "mmc". -Select "Add/Remove Snap-in" from the File menu. -Select "Certificates" in the left pane and click the "Add >" button. -Select "Computer Account", click "Next". -Select the appropriate option for "Select the computer you want this snap-in to manage.", click "Finish". -Click "OK". -Select and expand the Certificates (Local Computer) entry in the left pane. -Select and expand the Personal entry in the left pane. -Select the Certificates entry in the left pane. - -If no certificate for the domain controller exists in the right pane, this is a finding.WN00-000016<GroupDescription></GroupDescription>WN12-00-000016Backups of system-level information must be protected.<VulnDiscussion>A system backup will usually include sensitive information such as user accounts that could be used in an attack. As a valuable system resource, the system backup must be protected and stored in a physically secure location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>CODB-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure system-level information backups are stored in a secure location and protected from destruction.Determine if system-level information backups are protected from destruction and stored in a physically secure location. If they are not, this is a finding.WN00-000017<GroupDescription></GroupDescription>WN12-00-000017System-related documentation must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. - -Information system and security-related documentation contains information pertaining to system configuration and security settings. - -Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Back up system-related documentation in accordance with local recovery time and recovery point objectives.Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives. If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.WNGE-000007<GroupDescription></GroupDescription>WN12-GE-000007Permissions for program file directories must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. - -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002165Maintain the default permissions for the program file directories and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (V-3377). - -Default Permissions: -\Program Files and \Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and filesThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. - -Verify the default permissions for the program file directories (Program Files and Program Files (x86)). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) - -Viewing in File Explorer: -For each folder, view the Properties. -Select the "Security" tab, and the "Advanced" button. - -Default Permissions: -\Program Files and \Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files - -Alternately, use Icacls: - -Open a Command prompt (admin). -Enter icacls followed by the directory: - -icacls "c:\program files" -icacls "c:\program files (x86)" - -The following results should be displayed as each is entered: - -c:\program files -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 filesWNGE-000006<GroupDescription></GroupDescription>WN12-GE-000006Permissions for system drive root directory (usually C:\) must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. - -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002165Maintain the default permissions for the system drive's root directory and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (V-3377). - -Default Permissions -C:\ -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -SYSTEM - Full control - This folder, subfolders and files -Administrators - Full control - This folder, subfolders and files -Users - Read & execute - This folder, subfolders and files -Users - Create folders / append data - This folder and subfolders -Users - Create files / write data - Subfolders only -CREATOR OWNER - Full Control - Subfolders and files onlyThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. - -Verify the default permissions for the system drive's root directory (usually C:\). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) - -Viewing in File Explorer: -View the Properties of system drive root directory. -Select the "Security" tab, and the "Advanced" button. - -C:\ -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -SYSTEM - Full control - This folder, subfolders and files -Administrators - Full control - This folder, subfolders and files -Users - Read & execute - This folder, subfolders and files -Users - Create folders / append data - This folder and subfolders -Users - Create files / write data - Subfolders only -CREATOR OWNER - Full Control - Subfolders and files only - -Alternately, use Icacls: - -Open a Command prompt (admin). -Enter icacls followed by the directory: - -icacls c:\ - -The following results should be displayed: - -c:\ -NT AUTHORITY\SYSTEM:(OI)(CI)(F) -BUILTIN\Administrators:(OI)(CI)(F) -BUILTIN\Users:(OI)(CI)(RX) -BUILTIN\Users:(CI)(AD) -BUILTIN\Users:(CI)(IO)(WD) -CREATOR OWNER:(OI)(CI)(IO)(F) -Successfully processed 1 files; Failed processing 0 filesWNGE-000008<GroupDescription></GroupDescription>WN12-GE-000008Permissions for Windows installation directory must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. - -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001499CCI-002165Maintain the default file ACLs and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (V-3377). - -Default Permissions: -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and filesThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. - -Verify the default permissions for the Windows installation directory (usually C:\Windows). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) - -Viewing in File Explorer: -View the Properties of the folder. -Select the "Security" tab, and the "Advanced" button. - -Default Permissions: -\Windows -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files - -Alternately, use Icacls: - -Open a Command prompt (admin). -Enter icacls followed by the directory: - -icacls c:\windows - -The following results should be displayed: - -c:\windows -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 filesWN00-000009-02<GroupDescription></GroupDescription>WN12-00-000009-02Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure each member of the Backup Operators group has separate accounts for backup functions and standard user functions.If no accounts are members of the Backup Operators group, this is NA. - -Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding.WNAU-000060<GroupDescription></GroupDescription>WN12-AU-000060The system must be configured to audit Object Access - Central Access Policy Staging failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Object Access -> Central Policy Staging - FailureWNAU-000059<GroupDescription></GroupDescription>WN12-AU-000059The system must be configured to audit Object Access - Central Access Policy Staging successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Object Access -> Central Policy Staging - SuccessWNCC-000136<GroupDescription></GroupDescription>WN12-CC-000136Only the default client printer must be redirected to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Allowing the redirection of only the default client printer to a Remote Desktop session helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24504-3CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Printer Redirection -> "Redirect only the default client printer" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: RedirectOnlyDefaultClientPrinter - -Type: REG_DWORD -Value: 1WNSV-000106<GroupDescription></GroupDescription>WN12-SV-000106The Smart Card Removal Policy service must be configured to automatic.<VulnDiscussion>The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24365-9CCI-000366Configure the Startup Type for the Smart Card Removal Policy service to "Automatic".Verify the Smart Card Removal Policy service is configured to "Automatic". - -Run "Services.msc". - -If the Startup Type for Smart Card Removal Policy is not set to Automatic, this is a finding.WINPK-000004<GroupDescription></GroupDescription>WN12-PK-000004The US DoD CCEB Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000185CCI-002470Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. - -Issued To - Issued By - Thumbprint -DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - 929BF3196896994C0A201DF4A5B71F603FEFBF2E - -The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -NotAfter: 9/27/2019 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -Issued To: DoD Root CA 3 -Issuer by: US DoD CCEB Interoperability Root CA 2 -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -Valid: Friday, September 27, 2019WINFW-000001<GroupDescription></GroupDescription>WN12-FW-000001A host-based firewall must be installed and enabled on the system.<VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install and enable a host-based firewall on the system.Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. - -The configuration requirements will be determined by the applicable firewall STIG.WINCC-000138<GroupDescription></GroupDescription>WN12-CC-000138The display of slide shows on the lock screen must be disabled (Windows 2012 R2).<VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Configure the policy value for Computer Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Prevent enabling lock screen slide show" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ - -Value Name: NoLockScreenSlideshow - -Value Type: REG_DWORD -Value: 1WINCC-000139<GroupDescription></GroupDescription>WN12-CC-000139Windows 2012 R2 must include command line data in process creation events.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ - -Value Name: ProcessCreationIncludeCmdLine_Enabled - -Value Type: REG_DWORD -Value: 0x00000001 (1)WINCC-000140<GroupDescription></GroupDescription>WN12-CC-000140The network selection user interface (UI) must not be displayed on the logon screen (Windows 2012 R2).<VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Do not display network selection UI" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: DontDisplayNetworkSelectionUI - -Value Type: REG_DWORD -Value: 1WINCC-000141<GroupDescription></GroupDescription>WN12-CC-000141The setting to allow Microsoft accounts to be optional for modern style apps must be enabled (Windows 2012 R2).<VulnDiscussion>Control of credentials and the system must be maintained within the enterprise. Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> App Runtime -> "Allow Microsoft accounts to be optional" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - -Value Name: MSAOptional - -Value Type: REG_DWORD -Value: 1WINCC-000145<GroupDescription></GroupDescription>WN12-CC-000145Automatically signing in the last interactive user after a system-initiated restart must be disabled (Windows 2012 R2).<VulnDiscussion>Windows 2012 R2 can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Logon Options -> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. - -Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: DisableAutomaticRestartSignOn - -Value Type: REG_DWORD -Value: 1WINAU-000089<GroupDescription></GroupDescription>WN12-AU-000089The system must be configured to audit Policy Change - Authorization Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: --Open a Command Prompt with elevated privileges ("Run as Administrator"). --Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Policy Change -> Authorization Policy Change - SuccessWIN00-000018<GroupDescription></GroupDescription>WN12-00-000018The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. - -The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001774Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. - -Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows Server 2012. - -If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. - -Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: - -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmThis is applicable to unclassified systems; for other systems this is NA. - -Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. - -If an application whitelisting program is not in use on the system, this is a finding. - -Configuration of whitelisting applications will vary by the program. - -AppLocker is a whitelisting application built into Windows Server 2012. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. - -If AppLocker is used, perform the following to view the configuration of AppLocker: -Open PowerShell. - -If the AppLocker PowerShell module has not been previously imported, execute the following first: -Import-Module AppLocker - -Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: -Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml - -This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. - -Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: - -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmWINSO-000092<GroupDescription></GroupDescription>WN12-SO-000092Users must be required to enter a password to access private keys stored on the computer.<VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. - -The cornerstone of the PKI is the private key used to encrypt or digitally sign information. - -If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. - -Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000186Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ - -Value Name: ForceKeyProtection - -Type: REG_DWORD -Value: 2WIN00-000019<GroupDescription></GroupDescription>WN12-00-000019Protection methods such as TLS, encrypted VPNs, or IPSEC must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. - -Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. - -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPSEC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002420CCI-002422Configure protection methods such as TLS, encrypted VPNs, or IPSEC when the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process to maintain the confidentiality and integrity.If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPSEC have been implemented. If protection methods have not been implemented, this is a finding.WIN00-000020<GroupDescription></GroupDescription>WN12-00-000020Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.<VulnDiscussion>This requirement addresses protection of user-generated data, as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. - -Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001199CCI-002475CCI-002476Configure systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data to employ encryption to protect the confidentiality and integrity of all information at rest.Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. If it does not, this is a finding.WINGE-000056<GroupDescription></GroupDescription>WN12-GE-000056Windows 2012 / 2012 R2 must automatically remove or disable temporary user accounts after 72 hours.<VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. - -Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. - -If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. - -To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000016Configure temporary user accounts to automatically expire within 72 hours. - -Domain account can be configured with an account expiration date, under "Account" properties. - -Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account. - -Delete any temporary user accounts that are no longer necessary.Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. - -Review temporary user accounts for expiration dates. - -Open "PowerShell". - -Domain Controllers: - -Enter "Search-ADAccount -AccountExpiring -TimeSpan 3:00:00:00 | FT Name, AccountExpirationDate" -This will return any accounts configured to expire within the next 3 days. (The "TimeSpan" value to can be changed to find accounts configured to expire at various times such as 30 for the next month.) - -If any accounts identified as temporary are not listed, this is a finding. - -For any temporary accounts returned by the previous query: -Enter "Get-ADUser -Identity [Name] -Property WhenCreated" to determine when the account was created. - -If the "WhenCreated" date and "AccountExpirationDate" from the previous query are greater than 3 days apart, this is a finding. - -Member servers and standalone systems: - -Enter "Net User [username]", where [username] is the name of the temporary user account. - -If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding. - -If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.)WINGE-000057<GroupDescription></GroupDescription>WN12-GE-000057Windows 2012 / 2012 R2 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.<VulnDiscussion>Emergency administrator accounts are privileged accounts which are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. - -Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. - -To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001682Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours. - -Domain accounts can be configured with an account expiration date, under "Account" properties. - -Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the emergency administrator account.Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. - -If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. - -If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. - -Domain Controllers: - -Enter "Search-ADAccount -AccountExpiring -TimeSpan 3:00:00:00 | FT Name, AccountExpirationDate" -This will return any accounts configured to expire within the next 3 days. (The "TimeSpan" value to can be changed to find accounts configured to expire at various times such as 30 for the next month.) - -If any accounts identified as emergency administrator accounts are not listed, this is a finding. - -For any emergency administrator accounts returned by the previous query: -Enter "Get-ADUser -Identity [Name] -Property WhenCreated" to determine when the account was created. - -If the "WhenCreated" date and "AccountExpirationDate" from the previous query are greater than 3 days apart, this is a finding. - -Member servers and standalone systems: - -Enter "Net User [username]", where [username] is the name of the emergency administrator accounts. - -If "Account expires" has not been defined within 72 hours for any emergency administrator accounts, this is a finding. - -If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.)WINAU-000203<GroupDescription></GroupDescription>WN12-AU-000203-02The operating system must, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001851Configure the operating system to, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.Verify the operating system, at a minimum, off-loads audit records of interconnected systems in real time and off-loads standalone systems weekly. If it does not, this is a finding.WINAU-000213<GroupDescription></GroupDescription>WN12-AU-000213Event Viewer must be protected from unauthorized modification and deletion.<VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. - -Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001494CCI-001495Ensure only TrustedInstaller has permissions to change or modify Event Viewer ("%SystemRoot%\SYSTEM32\Eventvwr.exe). - -The default permissions below satisfy this requirement. -TrustedInstaller - Full Control -Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & ExecuteVerify the permissions on Event Viewer only allow TrustedInstaller permissions to change or modify. If any groups or accounts other than TrustedInstaller have Full control or Modify, this is a finding. - -Navigate to "%SystemRoot%\SYSTEM32". -View the permissions on "Eventvwr.exe". - -The default permissions below satisfy this requirement. -TrustedInstaller - Full Control -Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & ExecuteWINCC-000150<GroupDescription></GroupDescription>WN12-CC-000150WDigest Authentication must be disabled.<VulnDiscussion>When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled". - -Note: Microsoft Security Advisory update 2871997 is required for this setting to be effective on Windows 2012. It is not required for Windows 2012 R2. - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ - -Value Name: UseLogonCredential - -Type: REG_DWORD -Value: 0x00000000 (0) - -Note: Microsoft Security Advisory update 2871997 is required for this setting to be effective on Windows 2012. It is not required for Windows 2012 R2.WIN00-000170<GroupDescription></GroupDescription>WN12-00-000170The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. - -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". - -The system must be restarted for the change to take effect. - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2. - -Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ - -Value Name: SMB1 - -Type: REG_DWORD -Value: 0x00000000 (0)WIN00-000180<GroupDescription></GroupDescription>WN12-00-000180The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. - -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". - -Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client (extra setting needed for pre-Win8.1/2012R2)" to "Enabled" with the following three lines of text entered for "Configure LanmanWorkstation Dependencies": -Bowser -MRxSmb20 -NSI - -The system must be restarted for the changes to take effect. - -These policy settings requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2. - -Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA. - -If the following registry value is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ - -Value Name: Start - -Type: REG_DWORD -Value: 0x00000004 (4) - -If the following registry value includes MRxSmb10, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\ - -Value Name: DependOnService - -Type: REG_MULTI_SZ -Value: Default values after removing MRxSmb10 include the following, which are not a finding: -Bowser -MRxSmb20 -NSIWIN00-000160<GroupDescription></GroupDescription>WN12-00-000160The Server Message Block (SMB) v1 protocol must be disabled on Windows 2012 R2.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. - -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381Run "Windows PowerShell" with elevated privileges (run as administrator). -Enter the following: -Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol - -Alternately: -Search for "Features". -Select "Turn Windows features on or off". -De-select "SMB 1.0/CIFS File Sharing Support". - -The system must be restarted for the changes to take effect.This requirement applies to Windows 2012 R2, it is NA for Windows 2012 (see V-73519 and V-73523 for 2012 requirements). - -Different methods are available to disable SMBv1 on Windows 2012 R2. This is the preferred method, however if V-73519 and V-73523 are configured, this is NA. - -Run "Windows PowerShell" with elevated privileges (run as administrator). -Enter the following: -Get-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol - -If "State : Enabled" is returned, this is a finding. - -Alternately: -Search for "Features". -Select "Turn Windows features on or off". - -If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding.WIN00-000190<GroupDescription></GroupDescription>WN12-00-000190Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2012 / 2012 R2.<VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.Review the effective User Rights setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) - -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.WINAU-000501<GroupDescription></GroupDescription>WN12-AU-000030Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Account Lockout events can be used to identify potentially malicious logon attempts. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Account Lockout - SuccessWINAU-000502<GroupDescription></GroupDescription>WN12-AU-000031Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Logon/Logoff >> Account Lockout - FailureWINAU-000907<GroupDescription></GroupDescription>WN12-AU-000105Windows Server 2012/2012 R2 must be configured to audit System - Other System Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> Other System Events - SuccessWINAU-000908<GroupDescription></GroupDescription>WN12-AU-000106Windows Server 2012/2012 R2 must be configured to audit System - Other System Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> Other System Events - FailureWIN00-000200<GroupDescription></GroupDescription>WN12-00-000200Windows PowerShell must be updated to a version that supports script block logging on Windows 2012/2012 R2.<VulnDiscussion>Later versions of Windows PowerShell provide additional security and advanced logging features that can provide greater detail when malware has been run on a system. PowerShell 5.x includes the advanced logging features. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds advanced logging features. - -PowerShell is updated with the installation of the corresponding version of the Windows Management Framework (WMF). - -Updating to a later PowerShell version may have compatibility issues with some applications. The following links should be reviewed and updates tested before applying to a production environment. - -WMF 4.0: -Review the System Requirements under the download link - https://www.microsoft.com/en-us/download/details.aspx?id=40855 - -WMF 5.0: -https://docs.microsoft.com/en-us/powershell/wmf/5.0/productincompat - -WMF 5.1: -https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompat</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Update Windows PowerShell to version 4.0 or 5.x. - -Windows 2012 R2 includes PowerShell 4.0 by default. It may be updated with the installation of Windows Management Framework (WMF) 5.0 or 5.1. - -Windows 2012 requires the installation of Windows Management Framework (WMF) 4.0, 5.0, or 5.1. - -Updating to a later PowerShell version may have compatibility issues with some applications. The following links should be reviewed and updates tested before applying to a production environment. - -WMF 4.0: -Review the System Requirements under the download link - https://www.microsoft.com/en-us/download/details.aspx?id=40855 - -WMF 5.0: -https://docs.microsoft.com/en-us/powershell/wmf/5.0/productincompat - -WMF 5.1: -https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompatOpen "Windows PowerShell". - -Enter "$PSVersionTable". - -If the value for "PSVersion" is not 4.0 or 5.x, this is a finding. - -Windows 2012 R2 includes PowerShell 4.0 by default. Windows 2012 must be updated. If PowerShell 4.0 is used, the required patch for script block logging will be verified with the requirement to have that enabled.WIN00-000210<GroupDescription></GroupDescription>WN12-00-000210PowerShell script block logging must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system. - -PowerShell 5.x supports script block logging. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds support for script block logging.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000135Configure the following registry value as specified. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ - -Value Name: EnableScriptBlockLogging - -Value Type: REG_DWORD -Value: 0x00000001 (1) - -Administrative templates from later versions of Windows include a group policy setting for this. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". - -Install patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 on systems with PowerShell 4.0. - -PowerShell 5.x does not require the installation of an additional patch.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ - -Value Name: EnableScriptBlockLogging - -Value Type: REG_DWORD -Value: 0x00000001 (1) - -PowerShell 4.0 requires the installation of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012. - -If the patch is not installed on systems with PowerShell 4.0, this is a finding. - -PowerShell 5.x does not require the installation of an additional patch.WIN00-000220<GroupDescription></GroupDescription>WN12-00-000220Windows PowerShell 2.0 must not be installed on Windows 2012/2012 R2.<VulnDiscussion>Windows PowerShell versions 4.0 (with a patch) and 5.x add advanced logging features that can provide additional detail when malware has been run on a system. Ensuring Windows PowerShell 2.0 is not installed as well mitigates against a downgrade attack that evades the advanced logging features of later Windows PowerShell versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000381Windows PowerShell 2.0 is not installed by default. - -Uninstall it if it has been installed. - -Open "Windows PowerShell". - -Enter "Uninstall-WindowsFeature -Name PowerShell-v2". - -Alternately: - -Use the "Remove Roles and Features Wizard" and deselect "Windows PowerShell 2.0 Engine" under "Windows PowerShell".Windows PowerShell 2.0 is not installed by default. - -Open "Windows PowerShell". - -Enter "Get-WindowsFeature -Name PowerShell-v2". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.WINAD-000015-DC<GroupDescription></GroupDescription>WN12-AD-000015-DCThe password for the krbtgt account on a domain must be reset at least every 180 days.<VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). - -The password must be changed twice to effectively remove the password history.Changing once, waiting for replication to complete and the amount of time equal to or greater than the maximum Kerberos ticket lifetime, and changing again reduces the risk of issues. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Reset the password for the krbtgt account a least every 180 days. The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected. - -PowerShell scripts are available to accomplish this such as at the following link: -https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Select "Advanced Features" in the "View" menu if not previously selected. - -Select the "Users" node. - -Right click on the krbtgt account and select "Reset password". - -Enter a password that meets password complexity requirements. - -Clear the "User must change password at next logon" check box. - -The system will automatically change this to a system generated complex password.This requirement is applicable to domain controllers; it is NA for other systems. - -Open "Windows PowerShell". - -Enter "Get-ADUser krbtgt -Property PasswordLastSet". - -If the "PasswordLastSet" date is more than 180 days old, this is a finding.WN12-CC-000142<GroupDescription></GroupDescription>WN12-CC-000142The Windows Explorer Preview pane must be disabled for Windows 2012.<VulnDiscussion>A known vulnerability in Windows could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane. - -Organizations must disable the Windows Preview pane and Windows Detail pane. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure the following settings are configured for Windows 2012 locally or applied through group policy. - -Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn off Preview Pane" to "Enabled". - -Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn on or off details pane" to "Enabled" and "Configure details pane" to "Always hide". -If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - -Value Name: NoPreviewPane - -Value Type: REG_DWORD - -Value: 1 - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - -Value Name: NoReadingPane - -Value Type: REG_DWORD - -Value: 1 diff --git a/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V3R2_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V3R2_Manual-xccdf.log new file mode 100644 index 000000000..b8090cff8 --- /dev/null +++ b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V3R2_Manual-xccdf.log @@ -0,0 +1,28 @@ +V-226048::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct AntiVirus service information'} +V-226064::"Store password using reversible encryption"::"Store passwords using reversible encryption" +V-226066::0 or greater than 600 minutes::"0" or greater than "600" minutes +V-226067::0 or greater than 10 hours::"0" or greater than "10" hours +V-226068::is greater than 7 days::is greater than "7" days +V-226069::is greater than 5 minutes::is greater than "5" minutes +V-226062::"Minimum password length,"::"Minimum password length" +V-226070::*::'' +V-226194::Value: 0x00000001 (1) ::Value: 1 Or 2 +V-226256::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Certificate Revocation Checking service information'} +V-226236::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Firewall service information'} +V-226053::*::HardCodedRule(AuditSettingRule)@{DscResource = 'AuditSetting'; DesiredValue = '6.3.9600.17415'; Operator = '-ge'; Property = 'Version'; Query = "SELECT * FROM CIM_Datafile WHERE FileName='powershell' AND Path LIKE '%\\Windows\\System32\\WindowsPowerShell\\v1.0\\%' AND Extension='exe'"} +V-226054::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\::Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +V-226339::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'ConsentPromptBehaviorAdmin'; ValueType = 'Dword'; ValueData = $null; OrganizationValueTestString = "'{0}' -le '4'"} +V-226071::The following results should be displayed:::C:\Windows\SYSVOL +V-226071::NT AUTHORITY\Authenticated Users:(RX)::Type - "Allow" for all +V-226071::NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE)::Inherited from - "None" for all +V-226071::BUILTIN\Server Operators:(RX)::Principal - Access - Applies to +V-226071::BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE)::Authenticated Users - Read & execute - This folder, subfolder, and files +V-226071::BUILTIN\Administrators:(M,WDAC,WO)::'' +V-226071::BUILTIN\Administrators:(OI)(CI)(IO)(F)::Server Operators - Read & execute - This folder, subfolder, and files +V-226071::NT AUTHORITY\SYSTEM:(F)::Administrators - all selected except Full control - This folder only +V-226071::NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)::CREATOR OWNER - Full control - Subfolders and files only +V-226071::CREATOR OWNER:(OI)(CI)(IO)(F)::Administrators - Full control - Subfolders and files only +V-226071::(RX) - Read & execute::SYSTEM - Full control - This folder, subfolders, and files +V-226076::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient'; ValueName = 'Enabled'; ValueType = 'Dword'; ValueData = '1'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient'; ValueName = 'Type'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "'{0}' -match '^(NoSync|NTP|NT5DS|AllSync)$'"} +V-226289::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'LegalNoticeCaption'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "'{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$'"} +V-226288::assistants. Such communications and work product are private and confidential. See::assistants. Such communications and work product are private and confidential. See diff --git a/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V3R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V3R2_Manual-xccdf.xml new file mode 100644 index 000000000..44fb4203d --- /dev/null +++ b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V3R2_Manual-xccdf.xml @@ -0,0 +1,5080 @@ +acceptedMicrosoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 04 May 20213.2.2.360791.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>WN12-00-000001Server systems must be located in a controlled access area, accessible only to authorized personnel.<VulnDiscussion>Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security is the first line of protection of any system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52838V-1070CCI-000366Ensure servers are located in secure, access-controlled areas.Verify servers are located in controlled access areas that are accessible only to authorized personnel. If systems are not adequately protected, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000004Users with administrative privilege must be documented.<VulnDiscussion>Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those with this level of access are clearly identified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51575V-36658CCI-000366Create the necessary documentation that identifies the members of the Administrators group.Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000005Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.<VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51576V-36659CCI-000366Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. + +If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000006Policy must require that system administrators (SAs) be trained for the operating systems used by systems under their control.<VulnDiscussion>If SAs are assigned to systems running operating systems for which they have no training, these systems are at additional risk of unintentional misconfiguration that may result in vulnerabilities or decreased availability of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51577V-36666CCI-000366Establish site policy that requires SAs be trained for all operating systems running on systems under their control.Determine whether the site has a policy that requires SAs be trained for all operating systems running on systems under their control. If the site does not have a policy requiring SAs be trained for all operating systems under their control, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000007Windows 2012/2012 R2 password for the built-in Administrator account must be changed at least annually or when a member of the administrative team leaves the organization.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The password for the built-in Administrator account must be changed at least annually or when any member of the administrative team leaves the organization. + +Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52942V-14225CCI-000366Change the built-in Administrator account password at least annually or whenever an administrator leaves the organization. More frequent changes are recommended. + +Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this.Review the password last set date for the built-in Administrator account. + +Domain controllers: + +Open "Windows PowerShell". + +Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | FL Name, SID, PasswordLastSet". + +If the "PasswordLastSet" date is greater than one year old, this is a finding. + +Member servers and standalone systems: + +Open "Windows PowerShell" or "Command Prompt". + +Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. + +(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) + +If the "PasswordLastSet" date is greater than one year old, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000008Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.<VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. + +Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email. + +The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51578V-36451CCI-000366Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Implement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. + +The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. + +If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000009-01Members of the Backup Operators group must be documented.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Visibility of members of the Backup Operators group must be maintained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52156V-1168CCI-000366Create the necessary documentation that identifies the members of the Backup Operators group.If no accounts are members of the Backup Operators group, this is NA. + +Any accounts that are members of the Backup Operators group, including application accounts, must be documented with the ISSO. If documentation of accounts that are members of the Backup Operators group is not maintained this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000009-02Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52157V-40198CCI-000366Ensure each member of the Backup Operators group has separate accounts for backup functions and standard user functions.If no accounts are members of the Backup Operators group, this is NA. + +Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>WN12-00-000010Policy must require application account passwords be at least 15 characters in length.<VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51579V-36661CCI-000205Establish a site policy that requires application/service account passwords that are manually managed to be at least 15 characters in length. Ensure the policy is enforced.Verify the site has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. If such a policy does not exist or has not been implemented, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000011Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.<VulnDiscussion>Setting application accounts to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51580V-36662CCI-000366Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. + +It is recommended that system-managed service accounts be used where possible.Determine if manually managed application/service accounts exist. If none exist, this is NA. + +If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. + +Identify manually managed application/service accounts. + +To determine the date a password was last changed: + +Domain controllers: + +Open "Windows PowerShell". + +Enter "Get-ADUser -Identity [application account name] -Properties PasswordLastSet | FL Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. + +If the "PasswordLastSet" date is more than one year old, this is a finding. + +Member servers and standalone systems: + +Open "Windows PowerShell" or "Command Prompt". + +Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. + +If the "Password Last Set" date is more than one year old, this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN12-00-000012Shared user accounts must not be permitted on the system.<VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1072SV-52839CCI-000764Remove unapproved shared accounts from the system. + +Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.Determine whether any shared accounts exist. If no shared accounts exist, this is NA. + +Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. + +If unapproved shared accounts exist, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000013Security configuration tools or equivalent processes must be used to configure and maintain platforms for security compliance.<VulnDiscussion>Security configuration tools such as Group Policies and Security Templates allow system administrators to consolidate security-related system settings into a single configuration file. These settings can then be applied consistently to any number of Windows machines.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52859V-1128CCI-000366Implement a process using security configuration tools or the equivalent to configure Windows systems to meet security requirements.Verify security configuration tools or equivalent processes are being used to configure Windows systems to meet security requirements. If security configuration tools or equivalent processes are not used, this is a finding. + +Security configuration tools that are integrated into Windows, such as Group Policies and Security Templates, may be used to configure platforms for security compliance. + +If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000014System-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. + +System-level information includes system-state information, operating system and application software, and licenses. + +Backups must be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52841V-1076CCI-000366Implement system-level information backups in accordance with local recovery time and recovery point objectives.Determine whether system-level information is backed up in accordance with local recovery time and recovery point objectives. If system-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.SRG-OS-000185-GPOS-00079<GroupDescription></GroupDescription>WN12-00-000015User-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. + +User-level information is data generated by information system and/or application users. + +Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36733SV-51581CCI-000366Implement user-level information backups in accordance with local recovery time and recovery point objectives.Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.SRG-OS-000185-GPOS-00079<GroupDescription></GroupDescription>WN12-00-000016Backups of system-level information must be protected.<VulnDiscussion>A system backup will usually include sensitive information such as user accounts that could be used in an attack. As a valuable system resource, the system backup must be protected and stored in a physically secure location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-40172SV-52130CCI-000366Ensure system-level information backups are stored in a secure location and protected from destruction.Determine if system-level information backups are protected from destruction and stored in a physically secure location. If they are not, this is a finding.SRG-OS-000185-GPOS-00079<GroupDescription></GroupDescription>WN12-00-000017System-related documentation must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. + +Information system and security-related documentation contains information pertaining to system configuration and security settings. + +Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52131V-40173CCI-000366Back up system-related documentation in accordance with local recovery time and recovery point objectives.Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives. If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.SRG-OS-000370-GPOS-00155<GroupDescription></GroupDescription>WN12-00-000018The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. + +The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72047V-57637CCI-001774Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows Server 2012. + +If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmThis is applicable to unclassified systems; for other systems this is NA. + +Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +If an application whitelisting program is not in use on the system, this is a finding. + +Configuration of whitelisting applications will vary by the program. + +AppLocker is a whitelisting application built into Windows Server 2012. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. + +If AppLocker is used, perform the following to view the configuration of AppLocker: +Open PowerShell. + +If the AppLocker PowerShell module has not been previously imported, execute the following first: +Import-Module AppLocker + +Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: +Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml + +This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmSRG-OS-000425-GPOS-00189<GroupDescription></GroupDescription>WN12-00-000019Protection methods such as TLS, encrypted VPNs, or IPSEC must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPSEC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72051V-57641CCI-002420CCI-002422Configure protection methods such as TLS, encrypted VPNs, or IPSEC when the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process to maintain the confidentiality and integrity.If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPSEC have been implemented. If protection methods have not been implemented, this is a finding.SRG-OS-000185-GPOS-00079<GroupDescription></GroupDescription>WN12-00-000020Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.<VulnDiscussion>This requirement addresses protection of user-generated data, as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. + +Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72055V-57645CCI-001199CCI-002475CCI-002476Configure systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data to employ encryption to protect the confidentiality and integrity of all information at rest.Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. If it does not, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000100The Windows 2012 / 2012 R2 system must use an anti-virus program.<VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52103V-1074CCI-000366Install an anti-virus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. + +If there is no anti-virus solution installed on the system, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-00-000160The Server Message Block (SMB) v1 protocol must be disabled on Windows 2012 R2.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. + +Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-73805SV-88471CCI-000381Run "Windows PowerShell" with elevated privileges (run as administrator). +Enter the following: +Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol + +Alternately: +Search for "Features". +Select "Turn Windows features on or off". +De-select "SMB 1.0/CIFS File Sharing Support". + +The system must be restarted for the changes to take effect.This requirement applies to Windows 2012 R2, it is NA for Windows 2012 (see V-73519 and V-73523 for 2012 requirements). + +Different methods are available to disable SMBv1 on Windows 2012 R2. This is the preferred method, however if V-73519 and V-73523 are configured, this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). +Enter the following: +Get-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol + +If "State : Enabled" is returned, this is a finding. + +Alternately: +Search for "Features". +Select "Turn Windows features on or off". + +If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-00-000170The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. + +Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-73519SV-88193CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". + +The system must be restarted for the change to take effect. + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2. + +Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ + +Value Name: SMB1 + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-00-000180The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. + +Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-73523SV-88205CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". + +Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client (extra setting needed for pre-Win8.1/2012R2)" to "Enabled" with the following three lines of text entered for "Configure LanmanWorkstation Dependencies": +Bowser +MRxSmb20 +NSI + +The system must be restarted for the changes to take effect. + +These policy settings requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2. + +Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA. + +If the following registry value is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ + +Value Name: Start + +Type: REG_DWORD +Value: 0x00000004 (4) + +If the following registry value includes MRxSmb10, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\ + +Value Name: DependOnService + +Type: REG_MULTI_SZ +Value: Default values after removing MRxSmb10 include the following, which are not a finding: +Bowser +MRxSmb20 +NSISRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-00-000190Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2012 / 2012 R2.<VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-90603V-75915CCI-000366Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.Review the effective User Rights setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN12-00-000200Windows PowerShell must be updated to a version that supports script block logging on Windows 2012/2012 R2.<VulnDiscussion>Later versions of Windows PowerShell provide additional security and advanced logging features that can provide greater detail when malware has been run on a system. PowerShell 5.x includes the advanced logging features. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds advanced logging features. + +PowerShell is updated with the installation of the corresponding version of the Windows Management Framework (WMF). + +Updating to a later PowerShell version may have compatibility issues with some applications. The following links should be reviewed and updates tested before applying to a production environment. + +WMF 4.0: +Review the System Requirements under the download link - https://www.microsoft.com/en-us/download/details.aspx?id=40855 + +WMF 5.0: +https://docs.microsoft.com/en-us/powershell/wmf/5.0/productincompat + +WMF 5.1: +https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompat</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-95179V-80473CCI-000366Update Windows PowerShell to version 4.0 or 5.x. + +Windows 2012 R2 includes PowerShell 4.0 by default. It may be updated with the installation of Windows Management Framework (WMF) 5.0 or 5.1. + +Windows 2012 requires the installation of Windows Management Framework (WMF) 4.0, 5.0, or 5.1. + +Updating to a later PowerShell version may have compatibility issues with some applications. The following links should be reviewed and updates tested before applying to a production environment. + +WMF 4.0: +Review the System Requirements under the download link - https://www.microsoft.com/en-us/download/details.aspx?id=40855 + +WMF 5.0: +https://docs.microsoft.com/en-us/powershell/wmf/5.0/productincompat + +WMF 5.1: +https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompatOpen "Windows PowerShell". + +Enter "$PSVersionTable". + +If the value for "PSVersion" is not 4.0 or 5.x, this is a finding. + +Windows 2012 R2 includes PowerShell 4.0 by default. Windows 2012 must be updated. If PowerShell 4.0 is used, the required patch for script block logging will be verified with the requirement to have that enabled.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>WN12-00-000210PowerShell script block logging must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system. + +PowerShell 5.x supports script block logging. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds support for script block logging. + +Satisfies: SRG-OS-000042-GPOS-00021</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-95183V-80475CCI-000135Configure the following registry value as specified. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ + +Value Name: EnableScriptBlockLogging + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Administrative templates from later versions of Windows include a group policy setting for this. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". + +Install patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 on systems with PowerShell 4.0. + +PowerShell 5.x does not require the installation of an additional patch.If the following registry value does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ + +Value Name: EnableScriptBlockLogging + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +PowerShell 4.0 requires the installation of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012. + +If the patch is not installed on systems with PowerShell 4.0, this is a finding. + +PowerShell 5.x does not require the installation of an additional patch.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-00-000220Windows PowerShell 2.0 must not be installed on Windows 2012/2012 R2.<VulnDiscussion>Windows PowerShell versions 4.0 (with a patch) and 5.x add advanced logging features that can provide additional detail when malware has been run on a system. Ensuring Windows PowerShell 2.0 is not installed as well mitigates against a downgrade attack that evades the advanced logging features of later Windows PowerShell versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-95185V-80477CCI-000381Windows PowerShell 2.0 is not installed by default. + +Uninstall it if it has been installed. + +Open "Windows PowerShell". + +Enter "Uninstall-WindowsFeature -Name PowerShell-v2". + +Alternately: + +Use the "Remove Roles and Features Wizard" and deselect "Windows PowerShell 2.0 Engine" under "Windows PowerShell".Windows PowerShell 2.0 is not installed by default. + +Open "Windows PowerShell". + +Enter "Get-WindowsFeature -Name PowerShell-v2". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000329-GPOS-00128<GroupDescription></GroupDescription>WN12-AC-000001Windows 2012 account lockout duration must be configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52850V-1099CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. + +A value of "0" is also acceptable, requiring an administrator to unlock the account.Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. + +Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.SRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>WN12-AC-000002The number of allowed bad logon attempts must meet minimum requirements.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1097SV-52848CCI-000044Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy -> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy. + +If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.SRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>WN12-AC-000003The reset period for the account lockout counter must be configured to 15 minutes or greater on Windows 2012.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52849V-1098CCI-000044CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes.Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.SRG-OS-000077-GPOS-00045<GroupDescription></GroupDescription>WN12-AC-000004The password history must be configured to 24 passwords remembered.<VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52853V-1107CCI-000200Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN12-AC-000005The maximum password age must meet requirements.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1104SV-52851CCI-000199Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Maximum password age" to "60" days or less (excluding "0" which is unacceptable).Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. + +If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding.SRG-OS-000075-GPOS-00043<GroupDescription></GroupDescription>WN12-AC-000006The minimum password age must meet requirements.<VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1105SV-52852CCI-000198Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Minimum password age" to at least "1" day.Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. + +If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately."), this is a finding.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>WN12-AC-000007Passwords must, at a minimum, be 14 characters.<VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52938V-6836CCI-000205Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Minimum password length" to "14" characters.Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. + +If the value for the "Minimum password length," is less than "14" characters, this is a finding.SRG-OS-000069-GPOS-00037<GroupDescription></GroupDescription>WN12-AC-000008The built-in Windows password complexity policy must be enabled.<VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least 3 of the 4 types of characters (numbers, upper- and lower-case letters, and special characters), as well as preventing the inclusion of user names or parts of.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52863V-1150CCI-000192CCI-000193CCI-000194CCI-001619Configure the policy value for Computer Configuration >> Windows Settings -> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. + +Note: If an external password filter is in use that enforces all 4 character types and requires this setting be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>WN12-AC-000009Reversible password encryption must be disabled.<VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-2372SV-52880CCI-000196Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy -> "Store password using reversible encryption" to "Disabled".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. + +If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding.SRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000001The system must be configured to audit Account Logon - Credential Validation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53013V-26529CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Account Logon -> Credential Validation - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000002The system must be configured to audit Account Logon - Credential Validation failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53011V-26530CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Account Logon -> Credential Validation - FailureSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000015The system must be configured to audit Account Management - Other Account Management Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53009V-26533CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Other Account Management Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Account Management -> Other Account Management Events - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN12-AU-000017The system must be configured to audit Account Management - Security Group Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26535SV-53007CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Account Management -> Security Group Management - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN12-AU-000019The system must be configured to audit Account Management - User Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26537SV-53003CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Account Management -> User Account Management - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN12-AU-000020The system must be configured to audit Account Management - User Account Management failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53001V-26538CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Account Management -> User Account Management - FailureSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000023The system must be configured to audit Detailed Tracking - Process Creation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Process Creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52999V-26539CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Detailed Tracking -> Process Creation - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN12-AU-000030Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-92765V-78057CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: + +Open an elevated "Command Prompt" (run as administrator). + +Enter "AuditPol /get /category:*" + +Compare the AuditPol settings with the following. + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN12-AU-000031Windows Server 2012/2012 R2 must be configured to audit Logon/Logoff - Account Lockout failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-92769V-78059CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: + +Open an elevated "Command Prompt" (run as administrator). + +Enter "AuditPol /get /category:*" + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - FailureSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN12-AU-000045The system must be configured to audit Logon/Logoff - Logoff successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52996V-26540CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Logon/Logoff -> Logoff - SuccessSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN12-AU-000047The system must be configured to audit Logon/Logoff - Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52994V-26541CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Logon/Logoff -> Logon - SuccessSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN12-AU-000048The system must be configured to audit Logon/Logoff - Logon failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52993V-26542CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Logon/Logoff -> Logon - FailureSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN12-AU-000053The system must be configured to audit Logon/Logoff - Special Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52987V-26543CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Logon/Logoff -> Special Logon - SuccessSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN12-AU-000059The system must be configured to audit Object Access - Central Access Policy Staging successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52161V-40202CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Object Access -> Central Policy Staging - SuccessSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN12-AU-000060The system must be configured to audit Object Access - Central Access Policy Staging failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52159V-40200CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Object Access -> Central Policy Staging - FailureSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN12-AU-000081The system must be configured to audit Object Access - Removable Storage successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51601V-36668CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*" + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Success + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.SRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN12-AU-000082The system must be configured to audit Object Access - Removable Storage failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51604V-36667CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*" + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Failure + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>WN12-AU-000085The system must be configured to audit Policy Change - Audit Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26546SV-52983CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Policy Change -> Audit Policy Change - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000086The system must be configured to audit Policy Change - Audit Policy Change failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52982V-26547CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Policy Change -> Audit Policy Change - FailureSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000087The system must be configured to audit Policy Change - Authentication Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52981V-26548CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Policy Change -> Authentication Policy Change - SuccessSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN12-AU-000089The system must be configured to audit Policy Change - Authorization Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72043V-57633CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Policy Change -> Authorization Policy Change - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000101The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52980V-26549CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Privilege Use -> Sensitive Privilege Use - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000102The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52979V-26550CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +Privilege Use -> Sensitive Privilege Use - FailureSRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>WN12-AU-000103The system must be configured to audit System - IPsec Driver successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26551SV-52978CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +System -> IPsec Driver - SuccessSRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>WN12-AU-000104The system must be configured to audit System - IPsec Driver failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26552SV-52977CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +System -> IPsec Driver - FailureSRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>WN12-AU-000105Windows Server 2012/2012 R2 must be configured to audit System - Other System Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000458-GPOS-00203</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-78061SV-92773CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: + +Open an elevated "Command Prompt" (run as administrator). + +Enter "AuditPol /get /category:*" + +Compare the AuditPol settings with the following. + +If the system does not audit the following, this is a finding. + +System >> Other System Events - SuccessSRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>WN12-AU-000106Windows Server 2012/2012 R2 must be configured to audit System - Other System Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000458-GPOS-00203</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-78063SV-92781CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: + +Open an elevated "Command Prompt" (run as administrator). + +Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. + +If the system does not audit the following, this is a finding. + +System >> Other System Events - FailureSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000107The system must be configured to audit System - Security State Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52976V-26553CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +System -> Security State Change - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000109The system must be configured to audit System - Security System Extension successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52974V-26555CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +System -> Security System Extension - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000111The system must be configured to audit System - System Integrity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52972V-26557CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +System -> System Integrity - SuccessSRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>WN12-AU-000112The system must be configured to audit System - System Integrity failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52971V-26558CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. + +Use the AuditPol tool to review the current Audit Policy configuration: +-Open a Command Prompt with elevated privileges ("Run as Administrator"). +-Enter "AuditPol /get /category:*". + +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. + +System -> System Integrity - FailureSRG-OS-000255-GPOS-00096<GroupDescription></GroupDescription>WN12-AU-000200Audit data must be reviewed on a regular basis.<VulnDiscussion>To be of value, audit logs from critical systems must be reviewed on a regular basis. Critical systems should be reviewed on a daily basis to identify security breaches and potential weaknesses in the security structure. This can be done with the use of monitoring software or other utilities for this purpose.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51561V-36670CCI-000366Review audit logs on a predetermined scheduled.Determine whether audit logs are reviewed on a predetermined schedule. If audit logs are not reviewed on a regular basis, this is a finding.SRG-OS-000255-GPOS-00096<GroupDescription></GroupDescription>WN12-AU-000201Audit data must be retained for at least one year.<VulnDiscussion>Audit records are essential for investigating system activity after the fact. Retention periods for audit data are determined based on the sensitivity of the data handled by the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51563V-36671CCI-000366Ensure the audit data is retained for at least a year.Determine whether audit data is retained for at least one year. If the audit data is not retained for at least a year, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>WN12-AU-000203-01Audit records must be backed up onto a different system or media than the system being audited.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51566V-36672CCI-001851Establish and implement a process for backing up log data to another system or media other than the system being audited.Determine if a process to back up log data to a different system or media than the system being audited has been implemented. If it has not, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>WN12-AU-000203-02The operating system must, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72133V-57719CCI-001851Configure the operating system to, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.Verify the operating system, at a minimum, off-loads audit records of interconnected systems in real time and off-loads standalone systems weekly. If it does not, this is a finding.SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN12-AU-000204Permissions for the Application event log must prevent access by nonprivileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36722SV-51569CCI-000162CCI-000163CCI-000164Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having greater than Read access. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have greater than Read access. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. + +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN12-AU-000205Permissions for the Security event log must prevent access by nonprivileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51571V-36723CCI-000162CCI-000163CCI-000164Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. + +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN12-AU-000206Permissions for the System event log must prevent access by nonprivileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51572V-36724CCI-000162CCI-000163CCI-000164Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having greater than Read access. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have greater than Read access. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. + +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.SRG-OS-000257-GPOS-00098<GroupDescription></GroupDescription>WN12-AU-000213Event Viewer must be protected from unauthorized modification and deletion.<VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. + +Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72135V-57721CCI-001494CCI-001495Ensure only TrustedInstaller has permissions to change or modify Event Viewer ("%SystemRoot%\SYSTEM32\Eventvwr.exe). + +The default permissions below satisfy this requirement. +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & ExecuteVerify the permissions on Event Viewer only allow TrustedInstaller permissions to change or modify. If any groups or accounts other than TrustedInstaller have Full control or Modify, this is a finding. + +Navigate to "%SystemRoot%\SYSTEM32". +View the permissions on "Eventvwr.exe". + +The default permissions below satisfy this requirement. +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & ExecuteSRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000001The Mapper I/O network protocol (LLTDIO) driver must be disabled.<VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53072V-15696CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery -> "Turn on Mapper I/O (LLTDIO) driver" to "Disabled".If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ + +Value Name: AllowLLTDIOOndomain +Value Name: AllowLLTDIOOnPublicNet +Value Name: EnableLLTDIO +Value Name: ProhibitLLTDIOOnPrivateNet + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000002The Responder network protocol driver must be disabled.<VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15697SV-53081CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery -> "Turn on Responder (RSPNDR) driver" to "Disabled".If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ + +Value Name: AllowRspndrOndomain +Value Name: AllowRspndrOnPublicNet +Value Name: EnableRspndr +Value Name: ProhibitRspndrOnPrivateNet + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000003Windows Peer-to-Peer networking services must be turned off.<VulnDiscussion>Peer-to-Peer applications can allow unauthorized access to a system and exposure of sensitive data. This setting will turn off the Microsoft Peer-to-Peer Networking Service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53012V-15666CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Microsoft Peer-to-Peer Networking Services -> "Turn off Microsoft Peer-to-Peer Networking Services" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Peernet\ + +Value Name: Disabled + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000004Network Bridges must be prohibited in Windows.<VulnDiscussion>A Network Bridge can connect two or more network segments, allowing unauthorized access or exposure of sensitive data. This setting prevents a Network Bridge from being installed and configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15667SV-53014CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Prohibit installation and configuration of Network Bridge on your DNS domain network" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Network Connections\ + +Value Name: NC_AllowNetBridge_NLA + +Type: REG_DWORD +Value: 0SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-CC-000005Domain users must be required to elevate when setting a networks location.<VulnDiscussion>Selecting an incorrect network location may allow greater exposure of a system. Elevation is required by default on nondomain systems to change network location. This setting configures elevation to also be required on domain-joined systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21960SV-53182CCI-001084Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Require domain users to elevate when setting a network's location" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Network Connections\ + +Value Name: NC_StdDomainUserSetLocation + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000006All Direct Access traffic must be routed through the internal network.<VulnDiscussion>Routing all Direct Access traffic through the internal network allows monitoring and prevents split tunneling.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53183V-21961CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Network Connections -> "Route all traffic through the internal network" to "Enabled: Enabled State".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ + +Value Name: Force_Tunneling + +Type: REG_SZ +Value: EnabledSRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000007The 6to4 IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26575SV-52970CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set 6to4 State" to "Enabled: Disabled State".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ + +Value Name: 6to4_State + +Type: REG_SZ +Value: DisabledSRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000008The IP-HTTPS IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26576SV-52969CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set IP-HTTPS State" to "Enabled: Disabled State". + +Note: "IPHTTPS URL:" must be entered in the policy even if set to Disabled State. Enter "about:blank".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface\ + +Value Name: IPHTTPS_ClientState + +Type: REG_DWORD +Value: 3SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000009The ISATAP IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26577SV-52968CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set ISATAP State" to "Enabled: Disabled State".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ + +Value Name: ISATAP_State + +Type: REG_SZ +Value: DisabledSRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN12-CC-000010The Teredo IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52967V-26578CCI-000382Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set Teredo State" to "Enabled: Disabled State".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ + +Value Name: Teredo_State + +Type: REG_SZ +Value: DisabledSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000011IP stateless autoconfiguration limits state must be enabled.<VulnDiscussion>IP stateless autoconfiguration could configure routes that circumvent preferred routes if not limited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51605V-36673CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> Parameters -> "Set IP Stateless Autoconfiguration Limits State" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: EnableIPAutoConfigurationLimits + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000012The configuration of wireless devices using Windows Connect Now must be disabled.<VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15698SV-53085CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Windows Connect Now -> "Configuration of wireless settings using Windows Connect Now" to "Disabled".If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ + +Value Name: DisableFlashConfigRegistrar +Value Name: DisableInBand802DOT11Registrar +Value Name: DisableUPnPRegistrar +Value Name: DisableWPDRegistrar +Value Name: EnableRegistrars + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000013The Windows Connect Now wizards must be disabled.<VulnDiscussion>Windows Connect Now provides wizards for tasks such as "Set up a wireless router or access point" and must not be available to users. Functions such as these may allow unauthorized connections to a system and the potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15699SV-53089CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> Windows Connect Now -> "Prohibit access of the Windows Connect Now wizards" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\UI\ + +Value Name: DisableWcnUi + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000016Windows Update must be prevented from searching for point and print drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting will prevent Windows from searching Windows Update for point and print drivers. Only the local driver store and server driver cache will be searched.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53184V-21963CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Printers -> "Extend Point and Print connection to search Windows Update" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DoNotInstallCompatibleDriverFromWindowsUpdate + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000018Optional component installation and component repair must be prevented from using Windows Update.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Optional component installation or repair must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51606V-36677CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> "Specify settings for optional component installation and component repair" to "Enabled" and with "Never attempt to download payload from Windows Update" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Servicing\ + +Value Name: UseWindowsUpdate + +Type: REG_DWORD +Value: 2SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000019Remote access to the Plug and Play interface must be disabled for device installation.<VulnDiscussion>Remote access to the Plug and Play interface could potentially allow connections by unauthorized devices. This setting configures remote access to the Plug and Play interface and must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15700SV-53094CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Allow remote access to the Plug and Play interface" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ + +Value Name: AllowRemoteRPC + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000020An Error Report must not be sent when a generic device driver is installed.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents an error report from being sent when a generic device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15702SV-53105CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Do not send a Windows error report when a generic driver is installed on a device" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ + +Value Name: DisableSendGenericDriverNotFoundToWER + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000021A system restore point must be created when a new device driver is installed.<VulnDiscussion>A system restore point allows a rollback if an issue is encountered when a new device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53099V-15701CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ + +Value Name: DisableSystemRestore + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000022Device metadata retrieval from the Internet must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting will prevent Windows from retrieving device metadata from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21964SV-53185CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Installation >> "Prevent device metadata retrieval from the Internet" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Device Metadata\ + +Value Name: PreventDeviceMetadataFromNetwork + +Value Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000023Windows must be prevented from sending an error report when a device driver requests additional software during installation.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting will prevent Windows from sending an error report to Microsoft when a device driver requests additional software during installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-28504SV-52962CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent Windows from sending an error report when a device driver requests additional software during installation" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ + +Value Name: DisableSendRequestAdditionalSoftwareToWER + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000024Device driver searches using Windows Update must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting will prevent the system from searching Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53186V-21965CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify search order for device driver source locations" to "Enabled: Do not search Windows Update".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ + +Value Name: SearchOrderConfig + +Type: REG_DWORD +Value: 0SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000025Device driver updates must only search managed servers, not Windows Update.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Device driver updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51607V-36678CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify the search server for device driver updates" to "Enabled" with "Search Managed Server" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ + +Value Name: DriverServerSelection + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000026Users must not be prompted to search Windows Update for device drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents users from being prompted to search Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53115V-15703CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Driver Installation -> "Turn off Windows Update device driver search prompt" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ + +Value Name: DontPromptForWindowsUpdate + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000027Early Launch Antimalware, Boot-Start Driver Initialization Policy must be enabled and configured to only Good and Unknown.<VulnDiscussion>Compromised boot drivers can introduce malware prior to some protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51608V-36679CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Early Launch Antimalware -> "Boot-Start Driver Initialization Policy" to "Enabled" with "Good and Unknown" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Policies\EarlyLaunch\ + +Value Name: DriverLoadPolicy + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000028Group Policy objects must be reprocessed even if they have not changed.<VulnDiscussion>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52933V-4448CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy -> "Configure registry policy processing" to "Enabled" and select the option "Process even if the Group Policy objects have not changed".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ + +Value Name: NoGPOListChanges + +Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000029Group Policies must be refreshed in the background if the user is logged on.<VulnDiscussion>If this setting is enabled, then Group Policy settings are not refreshed while a user is currently logged on. This could lead to instances when a user does not have the latest changes to a policy applied and is therefore operating in an insecure context.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52906V-3469CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Group Policy -> "Turn off background refresh of Group Policy" to "Disabled".Review the registry. +If the following registry value does not exist, this is not a finding (this is the expected result from configuring the policy as outlined in the Fix section.): +If the following registry value exists but is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\system\ + +Value Name: DisableBkGndGroupPolicy + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000030Access to the Windows Store must be turned off.<VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51609V-36680CCI-000366If the \Windows\WinStore directory exists, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off access to the Store" to "Enabled". + +Alternately, uninstall the "Desktop Experience" feature from Windows 2012. This is located under "User Interfaces and Infrastructure" in the "Add Roles and Features Wizard". The \Windows\WinStore directory may need to be manually deleted after this.The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoUseStoreOpenWith + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000032Downloading print driver packages over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52998V-14260CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off downloading of print drivers over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableWebPnPDownload + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000033Event Viewer Events.asp links must be turned off.<VulnDiscussion>Viewing events is a function of administrators, who must not access the internet with privileged accounts. This setting will disable Events.asp hyperlinks in Event Viewer to prevent links to the internet from within events.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15672SV-53017CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Event Viewer "Events.asp" links" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\EventViewer\ + +Value Name: MicrosoftEventVwrDisableLinks + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000035Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents errors in handwriting recognition on tablet PCs from being reported to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15704SV-53116CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off handwriting recognition error reporting" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\HandwritingErrorReports\ + +Value Name: PreventHandwritingErrorReports + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000038The Internet File Association service must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents unhandled file associations from using the Microsoft Web service to find an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15674SV-53021CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Internet File Association service" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoInternetOpenWith + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000039Printing over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14259SV-52997CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off printing over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableHTTPPrinting + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000045The Windows Customer Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting ensures the Windows Customer Experience Improvement Program is disabled so information is not passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53143V-16020CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Windows Customer Experience Improvement Program" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\SQMClient\Windows\ + +Value Name: CEIPEnable + +Type: REG_DWORD +Value: 0SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000047Windows must be prevented from using Windows Update to search for drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents Windows from searching Windows Update for device drivers when no local drivers for a device are present.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53000V-14261CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Windows Update device driver searching" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ + +Value Name: DontSearchWindowsUpdate + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000048Copying of user input methods to the system account for sign-in must be prevented.<VulnDiscussion>Allowing different input methods for sign-in could open different avenues of attack. User input methods must be restricted to those enabled for the system account at sign-in.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36681SV-51610CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Locale Services -> "Disallow copying of user input methods to the system account for sign-in" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Control Panel\International\ + +Value Name: BlockUserInputMethodsForSignIn + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000051Local users on domain-joined computers must not be enumerated.<VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36684SV-51611CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Enumerate local users on domain-joined computers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\System\ + +Value Name: EnumerateLocalUsers + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000052App notifications on the lock screen must be turned off.<VulnDiscussion>App notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36687SV-51612CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Turn off app notifications on the lock screen" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\System\ + +Value Name: DisableLockScreenAppNotifications + +Type: REG_DWORD +Value: 1SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>WN12-CC-000054Users must be prompted to authenticate on resume from sleep (on battery).<VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53131V-15705CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Power Management -> Sleep Settings -> "Require a password when a computer wakes (on battery)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: DCSettingIndex + +Type: REG_DWORD +Value: 1SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>WN12-CC-000055The user must be prompted to authenticate on resume from sleep (plugged in).<VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53132V-15706CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Power Management -> Sleep Settings -> "Require a password when a computer wakes (plugged in)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: ACSettingIndex + +Type: REG_DWORD +Value: 1SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-CC-000058The system must be configured to prevent unsolicited remote assistance offers.<VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Unsolicited remote assistance is help that is offered by the remote user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3470SV-52917CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Offer Remote Assistance" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fAllowUnsolicited + +Type: REG_DWORD +Value: 0SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-CC-000059Solicited Remote Assistance must not be allowed.<VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52885V-3343CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Solicited Remote Assistance" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fAllowToGetHelp + +Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000062Remote Assistance log files must be generated.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. This setting will turn on session logging for Remote Assistance connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53133V-15707CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Turn on session logging" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: LoggingEnabled + +Type: REG_DWORD +Value: 1SRG-OS-000379-GPOS-00164<GroupDescription></GroupDescription>WN12-CC-000064-MSUnauthenticated RPC clients must be restricted from connecting to the RPC server.<VulnDiscussion>Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52988V-14253CCI-001967Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Procedure Call -> "Restrict Unauthenticated RPC clients" to "Enabled" and "Authenticated".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ + +Value Name: RestrictRemoteClients + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000065The detection of compatibility issues for applications and drivers must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36696SV-51737CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Application Compatibility Diagnostics -> "Detect compatibility issues for applications and drivers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\AppCompat\ + +Value Name: DisablePcaUI + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000066Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents the MSDT from communicating with and sending collected data to Microsoft, the default support provider.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21967SV-53187CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Microsoft Support Diagnostic Tool -> "Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy\ + +Value Name: DisableQueryRemoteServer + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000067Access to Windows Online Troubleshooting Service (WOTS) must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents users from searching troubleshooting content on Microsoft servers. Only local content will be available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21969SV-53188CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Scripted Diagnostics -> "Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy\ + +Value Name: EnableQueryRemoteServer + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000068Responsiveness events must be prevented from being aggregated and sent to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents responsiveness events from being aggregated and sent to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21970SV-53128CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Windows Performance PerfTrack -> "Enable/Disable PerfTrack" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}\ + +Value Name: ScenarioExecutionEnabled + +Type: REG_DWORD +Value: 0SRG-OS-000355-GPOS-00143<GroupDescription></GroupDescription>WN12-CC-000069The time service must synchronize with an appropriate DoD time source.<VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52919V-3472CCI-001891If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an authorized time server. + +The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.Open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator). + +Enter "W32tm /query /configuration". + +Domain-joined systems are automatically configured with a "Type" of "NT5DS" to synchronize with domain controllers and would not be a finding. + +If systems are configured with a "Type" of "NTP", including standalone systems and the forest root domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. (See V-8557 in the Active Directory Forest STIG for the time source requirement of the forest root domain PDC emulator.) + +If an alternate time synchronization tool is used and is not enabled or not configured to synchronize with a DoD time source, this is a finding. + +The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000070Trusted app installation must be enabled to allow for signed enterprise line of business apps.<VulnDiscussion>Enabling trusted app installation allows for enterprise line of business Windows 8 type apps. A trusted app package is one that is signed with a certificate chain that can be successfully validated in the enterprise. Configuring this ensures enterprise line of business apps are accessible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36697SV-51738CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> App Package Deployment -> "Allow all trusted apps to install" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Appx\ + +Value Name: AllowAllTrustedApps + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000071The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21971SV-53127CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Application Compatibility -> "Turn off Inventory Collector" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\AppCompat\ + +Value Name: DisableInventory + +Type: REG_DWORD +Value: 1SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN12-CC-000072Autoplay must be turned off for non-volume devices.<VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable Autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53126V-21973CCI-001764Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Disallow Autoplay for non-volume devices" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoAutoplayfornonVolume + +Type: REG_DWORD +Value: 1SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN12-CC-000073The default Autorun behavior must be configured to prevent Autorun commands.<VulnDiscussion>Allowing Autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents Autorun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53124V-22692CCI-001764Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Set the default behavior for AutoRun" to "Enabled:Do not execute any autorun commands".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoAutorun + +Type: REG_DWORD +Value: 1SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN12-CC-000074Autoplay must be disabled for all drives.<VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables Autoplay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52879V-2374CCI-001764Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies -> "Turn off AutoPlay" to "Enabled:All Drives".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ + +Value Name: NoDriveTypeAutoRun + +Type: REG_DWORD +Value: 0x000000ff (255)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000075The use of biometrics must be disabled.<VulnDiscussion>Allowing biometrics may bypass required authentication methods. Biometrics may only be used as an additional authentication factor where an enhanced strength of identity credential is necessary or desirable. Additional factors must be met per DoD policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51739V-36698CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Biometrics -> "Allow the use of biometrics" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Biometrics\ + +Value Name: Enabled + +Type: REG_DWORD +Value: 0SRG-OS-000079-GPOS-00047<GroupDescription></GroupDescription>WN12-CC-000076The password reveal button must not be displayed.<VulnDiscussion>Visible passwords may be seen by nearby persons, compromising them. The password reveal button can be used to display an entered password and must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36700SV-51740CCI-000206Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Credential User Interface -> "Do not display the password reveal button" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\CredUI\ + +Value Name: DisablePasswordReveal + +Type: REG_DWORD +Value: 1SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-CC-000077Administrator accounts must not be enumerated during elevation.<VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to enter in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14243SV-52955CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ + +Value Name: EnumerateAdministrators + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN12-CC-000084The Application event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52966V-26579CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN12-CC-000085The Security event log size must be configured to 196608 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52965V-26580CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "196608" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00030000 (196608) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN12-CC-000086The Setup event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52964V-26581CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Setup >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN12-CC-000087The System event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52963V-26582CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000088Windows SmartScreen must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36707SV-51747CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with either "Give user a warning before running downloaded unknown software" or "Require approval from an administrator before running downloaded unknown software" selected. + +Microsoft has changed this setting several times in the Windows 10 administrative templates, which will affect group policies in a domain if later templates are used. + +v1607 of Windows 10 and Windows Server 2016 changed the setting to only Enabled or Disabled without additional selections. Enabled is effectively "Give user a warning…". + +v1703 of Windows 10 or later administrative templates changed the policy name to "Configure Windows Defender SmartScreen", and the selectable options are "Warn" and "Warn and prevent bypass". When either of these are applied to a Windows 2012/2012 R2 system, it will configure the registry equivalent of "Give user a warning…").This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnableSmartScreen + +Type: REG_DWORD +Value: 0x00000001 (1) (Give user a warning…) +Or 0x00000002 (2) (Require approval…)SRG-OS-000433-GPOS-00192<GroupDescription></GroupDescription>WN12-CC-000089Explorer Data Execution Prevention must be enabled.<VulnDiscussion>Data Execution Prevention (DEP) provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53125V-21980CCI-002824Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off Data Execution Prevention for Explorer" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoDataExecutionPrevention + +Type: REG_DWORD +Value: 0SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-CC-000090Turning off File Explorer heap termination on corruption must be disabled.<VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53137V-15718CCI-002385Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off heap termination on corruption" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoHeapTerminationOnCorruption + +Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000091File Explorer shell protocol must run in protected mode.<VulnDiscussion>The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53045V-15683CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> File Explorer -> "Turn off shell protocol protected mode" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: PreXPSP2ShellProtocolBehavior + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000095The location feature must be turned off.<VulnDiscussion>The location service on systems may allow sensitive data to be used by applications on the system. This should be turned off unless explicitly allowed for approved systems/applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51748V-36708CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Location and Sensors -> "Turn off location" to "Enabled". + +If location services are approved by the organization for a device, this must be documented.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LocationAndSensors\ + +Value Name: DisableLocation + +Type: REG_DWORD +Value: 1 (Enabled) + +If location services are approved for the system by the organization, this may be set to "Disabled" (0). This must be documented with the ISSO.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>WN12-CC-000096Passwords must not be saved in the Remote Desktop Client.<VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52958V-14247CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Connection Client -> "Do not allow passwords to be saved" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: DisablePasswordSaving + +Type: REG_DWORD +Value: 1SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-CC-000098Local drives must be prevented from sharing with Remote Desktop Session Hosts. (Remote Desktop Services Role).<VulnDiscussion>Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52959V-14249CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow drive redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableCdm + +Type: REG_DWORD +Value: 1SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>WN12-CC-000099Remote Desktop Services must always prompt a client for passwords upon connection.<VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52898V-3453CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Always prompt for password upon connection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fPromptForPassword + +Type: REG_DWORD +Value: 1SRG-OS-000033-GPOS-00014<GroupDescription></GroupDescription>WN12-CC-000100Remote Desktop Services must be configured with the client connection encryption set to the required level.<VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3454SV-52899CCI-000068CCI-002890Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Set client connection encryption level" to "Enabled" and "High Level".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: MinEncryptionLevel + +Type: REG_DWORD +Value: 3SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000103Remote Desktop Services must delete temporary folders when a session is terminated.<VulnDiscussion>Remote desktop session temporary folders must always be deleted after a session is over to prevent hard disk clutter and potential leakage of information. This setting controls the deletion of the temporary folders when the session is terminated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52901V-3456CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders -> "Do not delete temp folder upon exit" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: DeleteTempDirsOnExit + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000104Remote Desktop Services must be configured to use session-specific temporary folders.<VulnDiscussion>If a communal temporary folder is used for remote desktop sessions, it might be possible for users to access other users' temporary folders. If this setting is enabled, only one temporary folder is used for all remote desktop sessions. Per session temporary folders must be established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52900V-3455CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Temporary Folders -> "Do not use temporary folders per session" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: PerSessionTempDir + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000105Attachments must be prevented from being downloaded from RSS feeds.<VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53040V-15682CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds -> "Prevent downloading of enclosures" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: DisableEnclosureDownload + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000106Basic authentication for RSS feeds over HTTP must be turned off.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51749V-36709CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> RSS Feeds -> "Turn on Basic feed authentication over HTTP" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: AllowBasicAuthInClear + +Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000109Automatic download of updates from the Windows Store must be turned off.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially allow sensitive information outside of the enterprise. Application updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51750V-36710CCI-000366The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. + +Windows 2012 R2: +Windows 2012 R2 split the original policy that configures this setting into two separate ones. Configuring either one to "Enabled" will update the registry value as identified in the Check section. + +Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> +"Turn off Automatic Download of updates on Win8 machines" or "Turn off Automatic Download and install of updates" to "Enabled". + +Windows 2012: +Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> "Turn off Automatic Download of updates" to "Enabled".The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. +If the following registry value does not exist or is not configured as specified, this is a finding: + +Windows 2012 R2: +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ + +Value Name: AutoDownload + +Type: REG_DWORD +Value: 0x00000002 (2) + +Windows 2012: +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\WindowsUpdate\ + +Value Name: AutoDownload + +Type: REG_DWORD +Value: 0x00000002 (2)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000110The Windows Store application must be turned off.<VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and provide access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51751V-36711CCI-000366The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. + +Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> "Turn off the Store application" to "Enabled".The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ + +Value Name: RemoveWindowsStore + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000115Users must be prevented from changing installation options.<VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53061V-15685CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Allow user control over installs" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Installer\ + +Value Name: EnableUserControl + +Type: REG_DWORD +Value: 0SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000116The Windows Installer Always install with elevated privileges option must be disabled.<VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52954V-34974CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Always install with elevated privileges" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Installer\ + +Value Name: AlwaysInstallElevated + +Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000117Users must be notified if a web-based program attempts to install software.<VulnDiscussion>Users must be aware of attempted program installations. This setting ensures users are notified if a web-based program attempts to install software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53056V-15684CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Installer\ + +Value Name: SafeForScripting + +Type: REG_DWORD +Value: 0SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000118Nonadministrators must be prevented from applying vendor-signed updates.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. This setting will prevent users from applying vendor-signed updates (though they may be from a trusted source).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53065V-15686CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Installer -> "Prohibit non-administrators from applying vendor signed updates" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\Installer\ + +Value Name: DisableLUAPatching + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000120Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This check verifies that Windows Media DRM will be prevented from accessing the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53139V-15722CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Digital Rights Management -> "Prevent Windows Media DRM Internet Access" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\WMDRM\ + +Value Name: DisableOnline + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000121Users must not be presented with Privacy and Installation options on first use of Windows Media Player.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting prevents users from being presented with Privacy and Installation options on first use of Windows Media Player, which could enable some communication with the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53069V-15687CCI-000366If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Do Not Show First Use Dialog Boxes" to "Enabled".Windows Media Player is not installed by default. If it is not installed, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ + +Value Name: GroupPrivacyAcceptance + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-CC-000122Windows Media Player must be configured to prevent automatic checking for updates.<VulnDiscussion>Uncontrolled system updates can introduce issues to a system. The automatic check for updates performed by Windows Media Player must be disabled to ensure a constant platform and to prevent the introduction of unknown\untested software on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53130V-3480CCI-001812If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Prevent Automatic Updates" to "Enabled".Windows Media Player is not installed by default. If it is not installed, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ + +Value Name: DisableAutoupdate + +Type: REG_DWORD +Value: 1SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN12-CC-000123The Windows Remote Management (WinRM) client must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36712SV-51752CCI-000877Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0SRG-OS-000393-GPOS-00173<GroupDescription></GroupDescription>WN12-CC-000124The Windows Remote Management (WinRM) client must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51753V-36713CCI-002890CCI-003123Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN12-CC-000125The Windows Remote Management (WinRM) client must not use Digest authentication.<VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36714SV-51754CCI-000877Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Client -> "Disallow Digest authentication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowDigest + +Type: REG_DWORD +Value: 0SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN12-CC-000126The Windows Remote Management (WinRM) service must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36718SV-51755CCI-000877Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0SRG-OS-000393-GPOS-00173<GroupDescription></GroupDescription>WN12-CC-000127The Windows Remote Management (WinRM) service must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51756V-36719CCI-002890CCI-003123Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>WN12-CC-000128The Windows Remote Management (WinRM) service must not store RunAs credentials.<VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51757V-36720CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Remote Management (WinRM) -> WinRM Service -> "Disallow WinRM from storing RunAs credentials" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: DisableRunAs + +Type: REG_DWORD +Value: 1SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>WN12-CC-000130The Remote Desktop Session Host must require secure RPC communications.<VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52932V-4447CCI-001453Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Require secure RPC communication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fEncryptRPCTraffic + +Type: REG_DWORD +Value: 1SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN12-CC-000132Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52224V-15997CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow COM port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableCcm + +Type: REG_DWORD +Value: 1SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN12-CC-000133Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52226V-15998CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow LPT port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableLPT + +Type: REG_DWORD +Value: 1SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN12-CC-000134The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).<VulnDiscussion>Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52230V-16000CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow smart card device redirection" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fEnableSmartCard + +Type: REG_DWORD +Value: 1SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN12-CC-000135Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52229V-15999CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow supported Plug and Play device redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisablePNPRedir + +Type: REG_DWORD +Value: 1SRG-OS-000114-GPOS-00059<GroupDescription></GroupDescription>WN12-CC-000136Only the default client printer must be redirected to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Allowing the redirection of only the default client printer to a Remote Desktop session helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52163V-40204CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Printer Redirection -> "Redirect only the default client printer" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: RedirectOnlyDefaultClientPrinter + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000138The display of slide shows on the lock screen must be disabled (Windows 2012 R2).<VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-56343V-43238CCI-000381This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Configure the policy value for Computer Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Prevent enabling lock screen slide show" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ + +Value Name: NoLockScreenSlideshow + +Value Type: REG_DWORD +Value: 1SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>WN12-CC-000139Windows 2012 R2 must include command line data in process creation events.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system. + +Satisfies: SRG-OS-000042-GPOS-00021</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-43239SV-56344CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ + +Value Name: ProcessCreationIncludeCmdLine_Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000140The network selection user interface (UI) must not be displayed on the logon screen (Windows 2012 R2).<VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-56346V-43240CCI-000381This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Logon -> "Do not display network selection UI" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: DontDisplayNetworkSelectionUI + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000141The setting to allow Microsoft accounts to be optional for modern style apps must be enabled (Windows 2012 R2).<VulnDiscussion>Control of credentials and the system must be maintained within the enterprise. Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-56353V-43241CCI-000366This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> App Runtime -> "Allow Microsoft accounts to be optional" to "Enabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + +Value Name: MSAOptional + +Value Type: REG_DWORD +Value: 1SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-CC-000142The Windows Explorer Preview pane must be disabled for Windows 2012.<VulnDiscussion>A known vulnerability in Windows could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane. + +Organizations must disable the Windows Preview pane and Windows Detail pane.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-111569V-102619CCI-000366Ensure the following settings are configured for Windows 2012 locally or applied through group policy. + +Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn off Preview Pane" to "Enabled". + +Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn on or off details pane" to "Enabled" and "Configure details pane" to "Always hide". +If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + +Value Name: NoPreviewPane + +Value Type: REG_DWORD + +Value: 1 + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + +Value Name: NoReadingPane + +Value Type: REG_DWORD + +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-CC-000145Automatically signing in the last interactive user after a system-initiated restart must be disabled (Windows 2012 R2).<VulnDiscussion>Windows 2012 R2 can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-56355V-43245CCI-000366This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Logon Options -> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. + +Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DisableAutomaticRestartSignOn + +Value Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-CC-000150WDigest Authentication must be disabled.<VulnDiscussion>When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-87391V-72753CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled". + +Note: Microsoft Security Advisory update 2871997 is required for this setting to be effective on Windows 2012. It is not required for Windows 2012 R2. + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ + +Value Name: UseLogonCredential + +Type: REG_DWORD +Value: 0x00000000 (0) + +Note: Microsoft Security Advisory update 2871997 is required for this setting to be effective on Windows 2012. It is not required for Windows 2012 R2.SRG-OS-000480-GPOS-00232<GroupDescription></GroupDescription>WN12-FW-000001A host-based firewall must be installed and enabled on the system.<VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-55085V-42420CCI-000366Install and enable a host-based firewall on the system.Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. + +The configuration requirements will be determined by the applicable firewall STIG.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN12-GE-000001Systems must be maintained at a supported service pack level.<VulnDiscussion>Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53189V-1073CCI-000366Update the system to a supported release or service pack level.Run "winver.exe". + +If the "About Windows" dialog box does not display +"Microsoft Windows Server +Version 6.2 (Build 9200)" +or greater, this is a finding. + +No preview versions will be used in a production environment. + +Unsupported Service Packs/Releases: +Windows 2012 - any release candidates or versions prior to the initial release.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-GE-000004-MSOnly administrators responsible for the member server must have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. + +System administrators must log on to systems only using accounts with the minimum level of authority necessary. + +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group (see V-36433 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. + +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51511V-1127CCI-002235Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. + +For domain-joined member servers, replace the Domain Admins group with a domain member server administrator group. + +Remove any standard user accounts.Review the local Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. + +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. + +Standard user accounts must not be members of the local Administrator group. + +If prohibited accounts are members of the local Administrators group, this is a finding. + +The built-in Administrator account or other required administrative accounts would not be a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-GE-000005Local volumes must use a format that supports NTFS attributes.<VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, local volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52843V-1081CCI-000213Format local volumes to use NTFS or ReFS.Open "Computer Management". + +Select "Disk Management" under "Storage". + +For each local volume, if the file system does not indicate "NTFS", this is a finding. + +"ReFS" (Resilient File System) is also acceptable and would not be a finding. + +“CSV” (Cluster Share Volumes) is also acceptable and would not be a finding. + +This does not apply to system partitions such as the Recovery and EFI System Partition.SRG-OS-000312-GPOS-00124<GroupDescription></GroupDescription>WN12-GE-000006Permissions for system drive root directory (usually C:\) must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52136V-40178CCI-002165Maintain the default permissions for the system drive's root directory and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (V-3377). + +Default Permissions +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders and files +Administrators - Full control - This folder, subfolders and files +Users - Read & execute - This folder, subfolders and files +Users - Create folders / append data - This folder and subfolders +Users - Create files / write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files onlyThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. + +Verify the default permissions for the system drive's root directory (usually C:\). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) + +Viewing in File Explorer: +View the Properties of system drive root directory. +Select the "Security" tab, and the "Advanced" button. + +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders and files +Administrators - Full control - This folder, subfolders and files +Users - Read & execute - This folder, subfolders and files +Users - Create folders / append data - This folder and subfolders +Users - Create files / write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + +Alternately, use Icacls: + +Open a Command prompt (admin). +Enter icacls followed by the directory: + +icacls c:\ + +The following results should be displayed: + +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) +CREATOR OWNER:(OI)(CI)(IO)(F) +Successfully processed 1 files; Failed processing 0 filesSRG-OS-000312-GPOS-00124<GroupDescription></GroupDescription>WN12-GE-000007Permissions for program file directories must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52135V-40177CCI-002165Maintain the default permissions for the program file directories and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (V-3377). + +Default Permissions: +\Program Files and \Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and filesThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. + +Verify the default permissions for the program file directories (Program Files and Program Files (x86)). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) + +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. + +Default Permissions: +\Program Files and \Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files + +Alternately, use Icacls: + +Open a Command prompt (admin). +Enter icacls followed by the directory: + +icacls "c:\program files" +icacls "c:\program files (x86)" + +The following results should be displayed as each is entered: + +c:\program files +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 filesSRG-OS-000259-GPOS-00100<GroupDescription></GroupDescription>WN12-GE-000008Permissions for Windows installation directory must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52137V-40179CCI-001499CCI-002165Maintain the default file ACLs and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (V-3377). + +Default Permissions: +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and filesThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. + +Verify the default permissions for the Windows installation directory (usually C:\Windows). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) + +Viewing in File Explorer: +View the Properties of the folder. +Select the "Security" tab, and the "Advanced" button. + +Default Permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files + +Alternately, use Icacls: + +Open a Command prompt (admin). +Enter icacls followed by the directory: + +icacls c:\windows + +The following results should be displayed: + +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 filesSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-GE-000010The system must not boot into multiple operating systems (dual-boot).<VulnDiscussion>Allowing a system to boot into multiple operating systems (dual-booting) may allow security to be circumvented on a secure system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52858V-1119CCI-000366Ensure Windows Server 2012 is the only operating system installed for the system to boot into. Remove alternate operating systems.Verify the local system boots directly into Windows. + +Open Control Panel. +Select "System". +Select the "Advanced System Settings" link. +Select the "Advanced" tab. +Click the "Startup and Recovery" Settings button. + +If the drop-down list box "Default operating system:" shows any operating system other than Windows Server 2012, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-GE-000012Nonadministrative user accounts or groups must only have print permissions on printer shares.<VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1135SV-52213CCI-000213Configure the permissions on shared printers to restrict standard users to only have Print permissions. This is typically given through the Everyone group by default.Open "Devices and Printers" in Control Panel or through Search. +If there are no printers configured, this is NA.(Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each configured printer: +Right click on the printer. +Select "Printer Properties". +Select the "Sharing" tab. +View whether "Share this printer" is checked. + +For any printers with "Share this printer" selected: +Select the Security tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. +Standard users will typically be given "Print" permission through the Everyone group. +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement.SRG-OS-000118-GPOS-00060<GroupDescription></GroupDescription>WN12-GE-000014Outdated or unused accounts must be removed from the system or disabled.<VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1112SV-52854CCI-000795Regularly review accounts to determine if they are still active. Disable or delete any active accounts that have not been used in the last 35 days.Run "PowerShell". + +Member servers and standalone systems: +Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) + +"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { + $user = ([ADSI]$_.Path) + $lastLogin = $user.Properties.LastLogin.Value + $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 + if ($lastLogin -eq $null) { + $lastLogin = 'Never' + } + Write-Host $user.Name $lastLogin $enabled +}" + +This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). +For example: User1 10/31/2015 5:49:56 AM True + +Domain Controllers: +Enter the following command in PowerShell. +"Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" + +This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. + +Review the list of accounts returned by the above queries to determine the finding validity for each account reported. + +Exclude the following accounts: +Built-in administrator account (Renamed, SID ending in 500) +Built-in guest account (Renamed, Disabled, SID ending in 501) +Application accounts + +If any enabled accounts have not been logged on to within the past 35 days, this is a finding. + +Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN12-GE-000015Windows 2012/2012 R2 accounts must be configured to require passwords.<VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-7002SV-52940CCI-000764Configure all enabled accounts to require passwords. + +The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.Review the password required status for enabled user accounts. + +Open "Windows PowerShell". + +Domain Controllers: + +Enter "Get-ADUser -Filter * -Properties PasswordNotRequired | Where PasswordNotRequired -eq True | FT Name, PasswordNotRequired, Enabled". + +Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs). + +If "PasswordNotRequired" is "True" for any enabled user account, this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. + +Exclude disabled accounts (e.g., Guest). + +If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN12-GE-000016Windows 2012/2012 R2 passwords must be configured to expire.<VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-6840SV-52939CCI-000199Configure all enabled user account passwords to expire. + +Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone systems. Document any exceptions with the ISSO.Review the password never expires status for enabled user accounts. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Domain Controllers: + +Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | Where PasswordNeverExpires -eq True | FT Name, PasswordNeverExpires, Enabled". + +Exclude application accounts and disabled accounts (e.g., Guest). +Domain accounts requiring smart card (CAC/PIV) may also be excluded. + +If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. + +Exclude application accounts and disabled accounts (e.g., Guest). + +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-GE-000017System files must be monitored for unauthorized changes.<VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52215V-2907CCI-000366Monitor system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. This can be done with the use of various monitoring tools.Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a finding. + +A properly configured and approved DoD HBSS solution that supports a File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-GE-000018Non system-created file shares on a system must limit access to groups that require it.<VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to those accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52881V-3245CCI-001090If a non-system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. + +Remove any unnecessary non-system-created shares.If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. +(System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) + +Run "Computer Management". +Navigate to System Tools >> Shared Folders >> Shares. + +Right click any non-system-created shares. +Select "Properties". +Select the "Share Permissions" tab. + +If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. + +Select the "Security" tab. + +If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN12-GE-000019The HBSS McAfee Agent must be installed.<VulnDiscussion>The McAfee Agent is the client side distributed component of McAfee ePolicy Orchestrator (McAfee ePO) which provides a secure communication channel between the ePO server and managed point products.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53010V-15505CCI-000366Deploy the McAfee Agent as detailed in accordance with the DoD HBSS STIG.Run "Services.msc". + +Verify the McAfee Agent service is running, depending on the version installed. + +Version - Service Name +McAfee Agent v5.x - McAfee Agent Service +McAfee Agent v4.x - McAfee Framework Service + +If the service is not listed or does not have a Status of "Started", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-GE-000020Software certificate installation files must be removed from Windows 2012/2012 R2.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53141V-15823CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. + +This does not apply to server-based applications that have a requirement for certificate files, Adobe PreFlight certificate files, or non-certificate installation files with the same extension.Search all drives for *.p12 and *.pfx files. + +If any files with these extensions exist, this is a finding. + +This does not apply to server-based applications that have a requirement for certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-GE-000021Necessary services must be documented to maintain a baseline to determine if additional, unnecessary services have been added to a system.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some services may be run under the local System account, which generally has more permissions than required by the service. Compromising a service could allow an intruder to obtain system permissions and open the system to a variety of attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52218V-3487CCI-000381Document the services required for the system to operate. Remove or disable any services that are not required.Required services will vary between organizations, and on the role of the individual system. Organizations will develop their own list of services which will be documented and justified with the ISSO. The site's list will be provided for any security review. Services common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system. + +Individual services specifically required to be disabled per the STIG are identified in separate requirements. + +If the site has not documented the services required for their system(s), this is a finding. + +The following can be used to view the services on a system: +Run "Services.msc". + +Services for Windows Server 2012 roles are managed automatically, adding those necessary for a particular role. The following lists the default services for a baseline installation as a reference. This can be used as a basis for documenting the services necessary. + +Default Installation +Name - Startup Type +Application Experience - Manual (Trigger Start) +Application Identity - Manual (Trigger Start) +Application Information - Manual +Application Layer Gateway Service - Manual +Application Management - Manual +Background Intelligent Transfer Service - Automatic (Delayed Start) +Background Tasks Infrastructure Service - Automatic +Base Filtering Engine - Automatic +Certificate Propagation - Manual +CNG Key Isolation - Manual (Trigger Start) +COM+ Event System - Automatic +COM+ System Application - Manual +Computer Browser - Disabled +Credential Manager - Manual +Cryptographic Services - Automatic +DCOM Server Process Launcher - Automatic +Device Association Service - Manual (Trigger Start) +Device Install Service - Manual (Trigger Start) +Device Setup Manager - Manual (Trigger Start) +DHCP Client - Automatic +Diagnostic Policy Service - Automatic (Delayed Start) +Diagnostic Service Host - Manual +Diagnostic System Host - Manual +Distributed Link Tracking Client - Automatic +Distributed Transaction Coordinator - Automatic (Delayed Start) +DNS Client - Automatic (Trigger Start) +Encrypting File System (EFS) - Manual (Trigger Start) +Extensible Authentication Protocol - Manual +Function Discovery Provider Host - Manual +Function Discovery Resource Publication - Manual +Group Policy Client - Automatic (Trigger Start) +Health Key and Certificate Management - Manual +Human Interface Device Access - Manual (Trigger Start) +Hyper-V Data Exchange Service - Manual (Trigger Start) +Hyper-V Guest Shutdown Service - Manual (Trigger Start) +Hyper-V Heartbeat Service - Manual (Trigger Start) +Hyper-V Remote Desktop Virtualization Service - Manual (Trigger Start) +Hyper-V Time Synchronization Service - Manual (Trigger Start) +Hyper-V Volume Shadow Copy Requestor - Manual (Trigger Start) +IKE and AuthIP IPsec Keying Modules - Manual (Trigger Start) +Interactive Services Detection - Manual +Internet Connection Sharing (ICS) - Disabled +IP Helper - Automatic +IPsec Policy Agent - Manual (Trigger Start) +KDC Proxy Server service (KPS) - Manual +KtmRm for Distributed Transaction Coordinator - Manual (Trigger Start) +Link-Layer Topology Discovery Mapper - Manual +Local Session Manager - Automatic +Microsoft iSCSI Initiator Service - Manual +Microsoft Software Shadow Copy Provider - Manual +Multimedia Class Scheduler - Manual +Net.Tcp Port Sharing Service - Disabled +Netlogon - Manual +Network Access Protection Agent - Manual +Network Connections - Manual +Network Connectivity Assistant - Manual (Trigger Start) +Network List Service - Manual +Network Location Awareness - Automatic +Network Store Interface Service - Automatic +Optimize drives - Manual +Performance Counter DLL Host - Manual +Performance Logs & Alerts - Manual +Plug and Play - Manual +Portable Device Enumerator Service - Manual (Trigger Start) +Power - Automatic +Print Spooler - Automatic +Printer Extensions and Notifications - Manual +Problem Reports and Solutions Control Panel Support - Manual +Remote Access Auto Connection Manager - Manual +Remote Access Connection Manager - Manual +Remote Desktop Configuration - Manual +Remote Desktop Services - Manual +Remote Desktop Services UserMode Port Redirector - Manual +Remote Procedure Call (RPC) - Automatic +Remote Procedure Call (RPC) Locator - Manual +Remote Registry - Automatic (Trigger Start) +Resultant Set of Policy Provider - Manual +Routing and Remote Access - Disabled +RPC Endpoint Mapper - Automatic +Secondary Logon - Manual +Secure Socket Tunneling Protocol Service - Manual +Security Accounts Manager - Automatic +Server - Automatic +Shell Hardware Detection - Automatic +Smart Card - Disabled +Smart Card Removal Policy - Manual +SNMP Trap - Manual +Software Protection - Automatic (Delayed Start, Trigger Start) +Special Administration Console Helper - Manual +Spot Verifier - Manual (Trigger Start) +SSDP Discovery - Disabled +Superfetch - Manual +System Event Notification Service - Automatic +Task Scheduler - Automatic +TCP/IP NetBIOS Helper - Automatic (Trigger Start) +Telephony - Manual +Themes - Automatic +Thread Ordering Server - Manual +UPnP Device Host - Disabled +User Access Logging Service - Automatic (Delayed Start) +User Profile Service - Automatic +Virtual Disk - Manual +Volume Shadow Copy - Manual +Windows All-User Install Agent - Manual (Trigger Start) +Windows Audio - Manual +Windows Audio Endpoint Builder - Manual +Windows Color System - Manual +Windows Driver Foundation - User-mode Driver Framework - Manual (Trigger Start) +Windows Error Reporting Service - Manual (Trigger Start) +Windows Event Collector - Manual +Windows Event Log - Automatic +Windows Firewall - Automatic +Windows Font Cache Service - Automatic +Windows Installer - Manual +Windows Licensing Monitoring Service - Automatic +Windows Management Instrumentation - Automatic +Windows Modules Installer - Manual +Windows Remote Management (WS-Management) - Automatic +Windows Store Service (WSService) - Manual (Trigger Start) +Windows Time - Manual (Trigger Start) +Windows Update - Manual +WinHTTP Web Proxy Auto-Discovery Service - Manual +Wired AutoConfig - Manual +WMI Performance Adapter - Manual +Workstation - AutomaticSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-GE-000022Servers must have a host-based Intrusion Detection System.<VulnDiscussion>A properly configured host-based Intrusion Detection System provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52105V-3289CCI-000366Install a host-based Intrusion Detection System on each server. + +Severity Override Guidance: This finding can be downgraded to a CAT III if there is an active JIDS or firewall protecting the network.Determine whether there is a host-based Intrusion Detection System on each server. + +If the HIPS component of HBSS is installed and active on the host and the Alerts of blocked activity are being logged and monitored, this will meet the requirement of this finding. + +A HID device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the site ISSO. + +If a host-based Intrusion Detection System is not installed on the system, this is a finding.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN12-GE-000023Windows Server 2012 / 2012 R2 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51582V-36734CCI-001233Install DoD-approved ESS software and ensure it is operating continuously.Verify DoD-approved ESS software is installed and properly operating. Ask the site ISSM for documentation of the ESS software installation and configuration. + +If the ISSM is not able to provide a documented configuration for an installed ESS or if the ESS software is not properly maintained or used, this is a finding. + +Note: Example of documentation can be a copy of the site's CCB approved Software Baseline with version of software noted or a memo from the ISSM stating current ESS software and version.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN12-GE-000024The system must support automated patch management tools to facilitate flaw remediation.<VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36735SV-51583CCI-000366Establish a process to automatically install security-related software updates.Verify the organization has an automated process to install security-related software updates. If it does not, this is a finding.SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN12-GE-000025The system must query the certification authority to determine whether a public key certificate has been revoked before accepting the certificate for authentication purposes.<VulnDiscussion>Failure to verify a certificate's revocation status can result in the system accepting a revoked, and therefore unauthorized, certificate. This could result in the installation of unauthorized software or a connection for rogue networks, depending on the use for which the certificate is intended. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51584V-36736CCI-000366Install software that provides certificate validation and revocation checking.Verify the system has software installed and running that provides certificate validation and revocation checking. If it does not, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-GE-000026File Transfer Protocol (FTP) servers must be configured to prevent anonymous logons.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. + +Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52106V-1120CCI-000366Configure the FTP service to prevent anonymous logons.If FTP is not installed on the system, this is NA. + +Determine the IP address and port number assigned to FTP sites from documentation or configuration. + +If Microsoft FTP is used, open "Internet Information Services (IIS) Manager". + +Select "Sites" under the server name. + +For any sites that reference FTP, view the Binding information for IP address and port. The standard port for FTP is 21, however this may be changed. + +Open a "Command Prompt". + +Attempt to log on as the user "anonymous" with the following commands: + +Note: Returned results may vary depending on the FTP server software. + +C:\> "ftp" +ftp> "Open IP Address Port" +(Substituting [IP Address] and [Port] with the information previously identified. If no IP Address was listed in the Binding, attempt using "localhost".) +(Connected to IP Address +220 Microsoft FTP Service) + +User (IP Address): "anonymous" +(331 Anonymous access allowed, send identity (e-mail name) as password.) + +Password: "password" +(230 User logged in.) +ftp> + +If the response indicates that an anonymous FTP login was permitted, this is a finding. + +If accounts with administrator privileges are used to access FTP, this is a CAT I finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-GE-000027File Transfer Protocol (FTP) servers must be configured to prevent access to the system drive.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Access outside of the specific directories of shared data could provide access to system resources and compromise the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52212V-1121CCI-000366Configure the system to only allow FTP access to specific folders containing the data to be available through the service.If FTP is not installed on the system, this is NA. + +Determine the IP address and port number assigned to FTP sites from documentation or configuration. + +If Microsoft FTP is used, open "Internet Information Services (IIS) Manager". + +Select "Sites" under the server name. + +For any sites that reference FTP, view the Binding information for IP address and port. The standard port for FTP is 21, however this may be changed. + +Open a "Command Prompt". + +Access the FTP site and review accessible directories with the following commands: + +Note: Returned results may vary depending on the FTP server software. + +C:\> "ftp" +ftp> "Open IP Address Port" +(Substituting [IP Address] and [Port] with the information previously identified. If no IP Address was listed in the Binding, attempt using "localhost".) +(Connected to IP Address +220 Microsoft FTP Service) + +User (IP Address): "FTP User" +(Substituting [FTP User] with an account identified that is allowed access. If it was determined that anonymous access was allowed to the site [see V-1120], also review access using "anonymous".) + (331 Password required) + +Password: "Password" +(Substituting [Password] with password for the account attempting access.) +(230 User ftpuser logged in.) + +ftp> "Dir" + +If the FTP session indicates access to areas of the system other than the specific folder for FTP data, such as the root of the drive, Program Files or Windows directories, this is a finding.SRG-OS-000002-GPOS-00002<GroupDescription></GroupDescription>WN12-GE-000056Windows 2012 / 2012 R2 must automatically remove or disable temporary user accounts after 72 hours.<VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. + +Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. + +If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. + +To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-72063V-57653CCI-000016Configure temporary user accounts to automatically expire within 72 hours. + +Domain account can be configured with an account expiration date, under "Account" properties. + +Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account. + +Delete any temporary user accounts that are no longer necessary.Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. + +Review temporary user accounts for expiration dates. + +Open "PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -AccountExpiring -TimeSpan 3:00:00:00 | FT Name, AccountExpirationDate" +This will return any accounts configured to expire within the next 3 days. (The "TimeSpan" value to can be changed to find accounts configured to expire at various times such as 30 for the next month.) + +If any accounts identified as temporary are not listed, this is a finding. + +For any temporary accounts returned by the previous query: +Enter "Get-ADUser -Identity [Name] -Property WhenCreated" to determine when the account was created. + +If the "WhenCreated" date and "AccountExpirationDate" from the previous query are greater than 3 days apart, this is a finding. + +Member servers and standalone systems: + +Enter "Net User [username]", where [username] is the name of the temporary user account. + +If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding. + +If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.)SRG-OS-000123-GPOS-00064<GroupDescription></GroupDescription>WN12-GE-000057Windows 2012 / 2012 R2 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.<VulnDiscussion>Emergency administrator accounts are privileged accounts which are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. + +Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. + +To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-57655SV-72065CCI-001682Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours. + +Domain accounts can be configured with an account expiration date, under "Account" properties. + +Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the emergency administrator account.Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. + +If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. + +If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. + +Domain Controllers: + +Enter "Search-ADAccount -AccountExpiring -TimeSpan 3:00:00:00 | FT Name, AccountExpirationDate" +This will return any accounts configured to expire within the next 3 days. (The "TimeSpan" value to can be changed to find accounts configured to expire at various times such as 30 for the next month.) + +If any accounts identified as emergency administrator accounts are not listed, this is a finding. + +For any emergency administrator accounts returned by the previous query: +Enter "Get-ADUser -Identity [Name] -Property WhenCreated" to determine when the account was created. + +If the "WhenCreated" date and "AccountExpirationDate" from the previous query are greater than 3 days apart, this is a finding. + +Member servers and standalone systems: + +Enter "Net User [username]", where [username] is the name of the emergency administrator accounts. + +If "Account expires" has not been defined within 72 hours for any emergency administrator accounts, this is a finding. + +If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.)SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN12-PK-000001The DoD Root CA certificates must be installed in the Trusted Root Store.<VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52961V-32272CCI-000185CCI-002470Install the DoD Root CA certificates. +DoD Root CA 2 +DoD Root CA 3 +DoD Root CA 4 +DoD Root CA 5 + +The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files.Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities. + +The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. + +Run "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter + +If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +NotAfter: 12/5/2029 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +NotAfter: 12/30/2029 + +Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +NotAfter: 7/25/2032 + +Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +NotAfter: 6/14/2041 + +Alternately use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates", click "Add". + +Select "Computer account", click "Next". + +Select "Local computer: (the computer this console is running on)", click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". + +For each of the DoD Root CA certificates noted below: + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +DoD Root CA 2 +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +Valid to: Wednesday, December 5, 2029 + +DoD Root CA 3 +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +Valid to: Sunday, December 30, 2029 + +DoD Root CA 4 +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +Valid to: Sunday, July 25, 2032 + +DoD Root CA 5 +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +Valid to: Friday, June 14, 2041SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN12-PK-000003The DoD Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-32274SV-52957CCI-000185CCI-002470Install the DoD Interoperability Root CA cross-certificates on unclassified systems. + +Issued To - Issued By - Thumbprint +DoD Root CA 2 - DoD Interoperability Root CA 1 - A8C27332CCB4CA49554CE55D34062A7DD2850C02 +DoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341 + +The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files.Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. + +Run "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is a finding. + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 +NotAfter: 1/22/2022 10:22:56 AM + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02 +NotAfter: 8/26/2022 9:25:51 AM + +Alternately use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates", click "Add". + +Select "Computer account", click "Next". + +Select "Local computer: (the computer this console is running on)", click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02 +Valid to: Friday, August 26, 2022 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 +Valid to: Saturday, January 22, 2022 +SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN12-PK-000004The US DoD CCEB Interoperability Root CA cross-certificates must be installed into the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52196V-40237CCI-000185CCI-002470Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. + +Issued To - Issued By - Thumbprint +DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9 + +The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files.Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. + +Run "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is a finding. + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9 +NotAfter: 8/26/2022 + +Alternately use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates", click "Add". + +Select "Computer account", click "Next". + +Select "Local computer: (the computer this console is running on)", click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9 +Valid: Friday, August 26, 2022 +SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-RG-000001Standard user accounts must only have Read permissions to the Winlogon registry key.<VulnDiscussion>Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53123V-26070CCI-002235Maintain permissions at least as restrictive as the defaults listed below for the "WinLogon" registry key. It is recommended to not change the permissions from the defaults. + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +The following are the same for each permission listed: +Type - Allow +Inherited from - MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion +Applies to - This key and subkeys + +Columns: Principal - Access +TrustedInstaller - Full Control +SYSTEM - Full Control +Administrators - Full Control +Users - Read +ALL APPLICATION PACKAGES - ReadRun "Regedit". +Navigate to the following registry key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Right-click on "WinLogon" and select "Permissions…". +Select "Advanced". + +If the permissions are not as restrictive as the defaults listed below, this is a finding. + +The following are the same for each permission listed: +Type - Allow +Inherited from - MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion +Applies to - This key and subkeys + +Columns: Principal - Access +TrustedInstaller - Full Control +SYSTEM - Full Control +Administrators - Full Control +Users - Read +ALL APPLICATION PACKAGES - ReadSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-RG-000002Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.<VulnDiscussion>Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52956V-32282CCI-002235Maintain the default permissions of the following registry keys: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ +HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only) + +Users - Read +Administrators - Full Control +SYSTEM - Full Control +CREATOR OWNER - Full Control (Subkeys only) +ALL APPLICATION PACKAGES - ReadRun "Regedit". +Navigate to the following registry keys and review the permissions: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ +HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems) + +If the default permissions listed below have been changed, this is a finding. + +Users - Read +Administrators - Full Control +SYSTEM - Full Control +CREATOR OWNER - Full Control (Subkeys only) +ALL APPLICATION PACKAGES - ReadSRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-RG-000003-MSLocal administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.<VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. + +With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36439SV-51590CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Apply UAC restrictions to local accounts on network logons" to "Enabled". + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the system is not a member of a domain, this is NA. +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LocalAccountTokenFilterPolicy + +Type: REG_DWORD +Value: 0x00000000 (0) + +This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans should use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to 1 may be required.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-RG-000004Anonymous access to the registry must be restricted.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require anonymous access to the registry. This must be limited to properly protect the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52864V-1152CCI-002235Maintain permissions at least as restrictive as the defaults listed below for the "winreg" registry key. It is recommended to not change the permissions from the defaults. + +HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ + +The following are the same for each permission listed: +Type - Allow +Inherited from - None + +Columns: Principal - Access - Applies to +Administrators - Full Control - This key and subkeys +Backup Operators - Read - This key only +LOCAL SERVICE - Read - This key and subkeysRun "Regedit". +Navigate to the following registry key: +HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ + +If the key does not exist, this is a finding. + +Right-click on "winreg" and select "Permissions…". +Select "Advanced". + +If the permissions are not as restrictive as the defaults listed below, this is a finding. + +The following are the same for each permission listed: +Type - Allow +Inherited from - None + +Columns: Principal - Access - Applies to +Administrators - Full Control - This key and subkeys +Backup Operators - Read - This key only +LOCAL SERVICE - Read - This key and subkeysSRG-OS-000121-GPOS-00062<GroupDescription></GroupDescription>WN12-SO-000003The built-in guest account must be disabled.<VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1113SV-52855CCI-000804Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Guest account status" to "Disabled".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. + +If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000004Local accounts with blank passwords must be restricted to prevent access from the network.<VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52886V-3344CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: LimitBlankPasswordUse + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000005The built-in administrator account must be renamed.<VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52857V-1115CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename administrator account" to a name other than "Administrator".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. + +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000006The built-in guest account must be renamed.<VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52856V-1114CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename guest account" to a name other than "Guest".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. + +If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding.SRG-OS-000142-GPOS-00071<GroupDescription></GroupDescription>WN12-SO-000007Auditing the Access of Global System Objects must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14228SV-53129CCI-001095Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the access of global system objects" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: AuditBaseObjects + +Value Type: REG_DWORD +Value: 0SRG-OS-000142-GPOS-00071<GroupDescription></GroupDescription>WN12-SO-000008Auditing of Backup and Restore Privileges must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting prevents the system from generating audit events for every file backed up or restored, which could fill the security log in Windows, making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52943V-14229CCI-001095Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the use of Backup and Restore privilege" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: FullPrivilegeAuditing + +Value Type: REG_BINARY +Value: 00SRG-OS-000062-GPOS-00031<GroupDescription></GroupDescription>WN12-SO-000009Audit policy using subcategories must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52944V-14230CCI-000169Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: SCENoApplyLegacyAuditPolicy + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000011Ejection of removable NTFS media must be restricted to Administrators.<VulnDiscussion>Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52875V-1171CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Allowed to format and eject removable media" to "Administrators".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: AllocateDASD + +Value Type: REG_SZ +Value: 0SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000012Outgoing secure channel traffic must be encrypted or signed.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52934V-6831CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireSignOrSeal + +Value Type: REG_DWORD +Value: 1SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000013Outgoing secure channel traffic must be encrypted when possible.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52871V-1163CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SealSecureChannel + +Value Type: REG_DWORD +Value: 1 + +If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831).SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000014Outgoing secure channel traffic must be signed when possible.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52872V-1164CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SignSecureChannel + +Value Type: REG_DWORD +Value: 1 + +If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831).SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000015The computer account password must not be prevented from being reset.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52873V-1165CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Disable machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: DisablePasswordChange + +Value Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000016The maximum age for machine account passwords must be set to requirements.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52887V-3373CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Maximum machine account password age" to "30" or less (excluding "0" which is unacceptable).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: MaximumPasswordAge + +Value Type: REG_DWORD +Value: 30 (or less, but not 0)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000017The system must be configured to require a strong session key.<VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52888V-3374CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireStrongKey + +Value Type: REG_DWORD +Value: 1 + +This setting may prevent a system from being joined to a domain if not configured consistently between systems.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000018The system must be configured to prevent the display of the last username on the logon screen.<VulnDiscussion>Displaying the username of the last logged on user provides half of the userid/password equation that an unauthorized person would need to gain access. The username of the last user to log on to a system must not be displayed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52941V-11806CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Do not display last user name" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DontDisplayLastUserName + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000019The Ctrl+Alt+Del security attention sequence for logons must be enabled.<VulnDiscussion>Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, a user can be assured that any passwords entered following that sequence are sent only to Windows. If the sequence requirement is eliminated, malicious programs can request and receive a user's Windows password. Disabling this sequence also suppresses a custom logon banner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52866V-1154CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Do not require CTRL+ALT+DEL" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DisableCAD + +Value Type: REG_DWORD +Value: 0SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>WN12-SO-000021The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36773SV-51596CCI-000057Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: InactivityTimeoutSecs + +Value Type: REG_DWORD +Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled)SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>WN12-SO-000022The required legal notice must be configured to display before console logon.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1089SV-52845CCI-000048CCI-000050CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message text for users attempting to log on" to the following: + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeText + +Value Type: REG_SZ +Value: See message text below + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>WN12-SO-000023The Windows dialog box title for the legal banner must be configured.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26359SV-53121CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. + +If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeCaption + +Value Type: REG_SZ +Value: See message title options below + +"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. + +If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089. + +Automated tools may only search for the titles defined above. If a site-defined title is used, a manual review will be required.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000024Caching of logon credentials must be limited.<VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52846V-1090CCI-000366If the system is not a member of a domain, this is NA. + +Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.If the system is not a member of a domain, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: CachedLogonsCount + +Value Type: REG_SZ +Value: 4 (or less)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000025Users must be warned in advance of their passwords expiring.<VulnDiscussion>Creating strong passwords that can be remembered by users requires some thought. By giving the user advance warning, the user has time to construct a sufficiently strong password. This setting configures the system to display a warning to users telling them how many days are left before their password expires.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52876V-1172CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Prompt user to change password before expiration" to "14" days or more.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: PasswordExpiryWarning + +Value Type: REG_DWORD +Value: 14 (or greater)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000027The Smart Card removal option must be configured to Force Logoff or Lock Workstation.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52867V-1157CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: SCRemoveOption + +Value Type: REG_SZ +Value: 1 (Lock Workstation) or 2 (Force Logoff) + +If configuring this on servers causes issues such as terminating users' remote sessions and the site has a policy in place that any other sessions on the servers such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO.SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000028The Windows SMB client must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52935V-6832CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 1SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000029The Windows SMB client must be enabled to perform SMB packet signing when possible.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52874V-1166CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 1SRG-OS-000074-GPOS-00042<GroupDescription></GroupDescription>WN12-SO-000030Unencrypted passwords must not be sent to third-party SMB Servers.<VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-1141SV-52861CCI-000197Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnablePlainTextPassword + +Value Type: REG_DWORD +Value: 0SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>WN12-SO-000031The amount of idle time required before suspending a session must be properly set.<VulnDiscussion>Open sessions can increase the avenues of attack on a system. This setting is used to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. This protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52878V-1174CCI-001133CCI-002361Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Server: Amount of idle time required before suspending session" to "15" minutes or less.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: autodisconnect + +Value Type: REG_DWORD +Value: 0x0000000f (15) (or less)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000032The Windows SMB server must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52936V-6833CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 1SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN12-SO-000033The Windows SMB server must perform SMB packet signing when possible.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52870V-1162CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 1SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>WN12-SO-000034Users must be forcibly disconnected when their logon hours expire.<VulnDiscussion>Users must not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. Forcibly disconnecting users when logon hours expire protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52860V-1136CCI-001133Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Disconnect clients when logon hours expire" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: EnableForcedLogoff + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000035The service principal name (SPN) target name validation level must be turned off.<VulnDiscussion>If a service principle name (SPN) is provided by the client, it is validated against the server's list of SPNs. Implementation may disrupt file and print sharing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53175V-21950CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Server SPN target name validation level" to "Off".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanmanServer\Parameters\ + +Value Name: SmbServerNameHardeningLevel + +Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>WN12-SO-000036Automatic logons must be disabled.<VulnDiscussion>Allowing a system to automatically log on when the machine is booted could give access to any unauthorized individual who restarts the computer. Automatic logon with administrator privileges would give full access to an unauthorized individual.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52107V-1145CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)" to "Disabled". + +Ensure no passwords are stored in the "DefaultPassword" registry value noted below: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: DefaultPassword + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.) + +Severity Override Guidance: If the DefaultName or DefaultDomainName in the same registry path contain an administrator account name and the DefaultPassword contains a value, this is a CAT I finding.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: AutoAdminLogon + +Type: REG_SZ +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000037IPv6 source routing must be configured to the highest protection level.<VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53180V-21955CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ + +Value Name: DisableIPSourceRouting + +Type: REG_DWORD +Value: 2SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000038The system must be configured to prevent IP source routing.<VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52924V-4110CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Highest protection, source routing is completely disabled". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: DisableIPSourceRouting + +Value Type: REG_DWORD +Value: 2SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000039The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.<VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52925V-4111CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: EnableICMPRedirect + +Value Type: REG_DWORD +Value: 0SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-SO-000041The system must be configured to limit how often keep-alive packets are sent.<VulnDiscussion>This setting controls how often TCP sends a keep-alive packet in attempting to verify that an idle connection is still intact. A higher value could allow an attacker to cause a denial of service with numerous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52927V-4113CCI-002385Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds" to "300000 or 5 minutes (recommended)" or less. + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: KeepAliveTime + +Value Type: REG_DWORD +Value: 300000 (or less)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000042IPSec Exemptions must be limited.<VulnDiscussion>IPSec exemption filters allow specific traffic that may be needed by the system for such things as Kerberos authentication. This setting configures Windows for specific IPSec exemptions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52945V-14232CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (NoDefaultExempt) Configure IPSec exemptions for various types of network traffic" to "Only ISAKMP is exempt (recommended for Windows Server 2003)". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\IPSEC\ + +Value Name: NoDefaultExempt + +Value Type: REG_DWORD +Value: 3SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-SO-000043The system must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52928V-4116CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ + +Value Name: NoNameReleaseOnDemand + +Value Type: REG_DWORD +Value: 1SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-SO-000044The system must be configured to disable the Internet Router Discovery Protocol (IRDP).<VulnDiscussion>The Internet Router Discovery Protocol (IRDP) is used to detect and configure default gateway addresses on the computer. If a router is impersonated on a network, traffic could be routed through the compromised system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52926V-4112CCI-002385Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)" to "Disabled". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: PerformRouterDiscovery + +Value Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000045The system must be configured to use Safe DLL Search Mode.<VulnDiscussion>The default search behavior, when an application calls a function in a Dynamic Link Library (DLL), is to search the current directory, followed by the directories contained in the system's path environment variable. An unauthorized DLL, inserted into an application's working directory, could allow malicious code to be run on the system. Setting this policy value forces the system to search the %Systemroot% for the DLL before searching the current directory or the rest of the path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52920V-3479CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)" to "Enabled". + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Session Manager\ + +Value Name: SafeDllSearchMode + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000046The system must be configured to have password protection take effect within a limited time frame when the screen saver becomes active.<VulnDiscussion>Allowing more than several seconds makes the computer vulnerable to a potential attack from someone walking up to the console to attempt to log on to the system before the lock takes effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52930V-4442CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)" to "5" or less. + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: ScreenSaverGracePeriod + +Value Type: REG_SZ +Value: 5 (or less)SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-SO-000047IPv6 TCP data retransmissions must be configured to prevent resources from becoming exhausted.<VulnDiscussion>Configuring Windows to limit the number of times that IPv6 TCP retransmits unacknowledged data segments before aborting the attempt helps prevent resources from becoming exhausted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53181V-21956CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ + +Value Name: TcpMaxDataRetransmissions + +Value Type: REG_DWORD +Value: 3 (or less)SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN12-SO-000048The system must limit how many times unacknowledged TCP data is retransmitted.<VulnDiscussion>In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52929V-4438CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: TcpMaxDataRetransmissions + +Value Type: REG_DWORD +Value: 3 (or less)SRG-OS-000046-GPOS-00022<GroupDescription></GroupDescription>WN12-SO-000049The system must generate an audit event when the audit log reaches a percentage of full threshold.<VulnDiscussion>When the audit log reaches a given percent full, an audit event is written to the security log. It is recorded as a successful audit event under the category of System. This option may be especially useful if the audit logs are set to be cleared manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-4108SV-52923CCI-000139CCI-001855CCI-001858Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning" to "90" or less. + +(See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the system is configured to write to an audit server, or is configured to automatically archive full logs, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\Eventlog\Security\ + +Value Name: WarningLevel + +Value Type: REG_DWORD +Value: 90 (or less)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000050Anonymous SID/Name translation must not be allowed.<VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52882V-3337CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Allow anonymous SID/Name translation" to "Disabled".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. + +If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000051Anonymous enumeration of SAM accounts must not be allowed.<VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53122V-26283CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymousSAM + +Value Type: REG_DWORD +Value: 1SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000052Anonymous enumeration of shares must be restricted.<VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52847V-1093CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymous + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000054The system must be configured to prevent anonymous users from having the same rights as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52890V-3377CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Let everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: EveryoneIncludesAnonymous + +Value Type: REG_DWORD +Value: 0SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000055-MSNamed pipes that can be accessed anonymously must be configured to contain no values on member servers.<VulnDiscussion>Named pipes that can be accessed anonymously provide the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3338SV-51497CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Named pipes that can be accessed anonymously" to be defined but containing no entries (blank).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: NullSessionPipes + +Value Type: REG_MULTI_SZ +Value: (blank) + +Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000056Unauthorized remotely accessible registry paths must not be configured.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52883V-3339CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths" with the following entries: + +System\CurrentControlSet\Control\ProductOptions +System\CurrentControlSet\Control\Server Applications +Software\Microsoft\Windows NT\CurrentVersionIf the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\ + +Value Name: Machine + +Value Type: REG_MULTI_SZ +Value: see below + +System\CurrentControlSet\Control\ProductOptions +System\CurrentControlSet\Control\Server Applications +Software\Microsoft\Windows NT\CurrentVersion + +Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000057Unauthorized remotely accessible registry paths and sub-paths must not be configured.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths and sub-paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-4443SV-52931CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths and sub-paths" with the following entries: + +Software\Microsoft\OLAP Server +Software\Microsoft\Windows NT\CurrentVersion\Perflib +Software\Microsoft\Windows NT\CurrentVersion\Print +Software\Microsoft\Windows NT\CurrentVersion\Windows +System\CurrentControlSet\Control\ContentIndex +System\CurrentControlSet\Control\Print\Printers +System\CurrentControlSet\Control\Terminal Server +System\CurrentControlSet\Control\Terminal Server\UserConfig +System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration +System\CurrentControlSet\Services\Eventlog +System\CurrentControlSet\Services\SysmonlogIf the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\ + +Value Name: Machine + +Value Type: REG_MULTI_SZ +Value: see below + +Software\Microsoft\OLAP Server +Software\Microsoft\Windows NT\CurrentVersion\Perflib +Software\Microsoft\Windows NT\CurrentVersion\Print +Software\Microsoft\Windows NT\CurrentVersion\Windows +System\CurrentControlSet\Control\ContentIndex +System\CurrentControlSet\Control\Print\Printers +System\CurrentControlSet\Control\Terminal Server +System\CurrentControlSet\Control\Terminal Server\UserConfig +System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration +System\CurrentControlSet\Services\Eventlog +System\CurrentControlSet\Services\Sysmonlog + +Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000058Anonymous access to Named Pipes and Shares must be restricted.<VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-6834SV-52937CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RestrictNullSessAccess + +Value Type: REG_DWORD +Value: 1SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000059Network shares that can be accessed anonymously must not be allowed.<VulnDiscussion>Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3340SV-52884CCI-001090Ensure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Shares that can be accessed anonymously" contains no entries (blank).If the following registry value does not exist, this is not a finding: + +If the following registry value does exist and is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: NullSessionShares + +Value Type: REG_MULTI_SZ +Value: (Blank)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN12-SO-000060The system must be configured to use the Classic security model.<VulnDiscussion>Windows includes two network-sharing security models - Classic and Guest only. With the Classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3378SV-52891CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Sharing and security model for local accounts" to "Classic - local users authenticate as themselves".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: ForceGuest + +Value Type: REG_DWORD +Value: 0SRG-OS-000114-GPOS-00059<GroupDescription></GroupDescription>WN12-SO-000061Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity vs. authenticating anonymously.<VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-21951SV-53176CCI-000778Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow Local System to use computer identity for NTLM" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\LSA\ + +Value Name: UseMachineId + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000062NTLM must be prevented from falling back to a Null session.<VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53177V-21952CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\LSA\MSV1_0\ + +Value Name: allownullsessionfallback + +Type: REG_DWORD +Value: 0SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000063PKU2U authentication using online identities must be prevented.<VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53178V-21953CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\LSA\pku2u\ + +Value Name: AllowOnlineID + +Type: REG_DWORD +Value: 0SRG-OS-000120-GPOS-00061<GroupDescription></GroupDescription>WN12-SO-000064Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.<VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. + +Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53179V-21954CCI-000803Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: + +AES128_HMAC_SHA1 +AES256_HMAC_SHA1 +Future encryption types + +Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.If the following registry value does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ + +Value Name: SupportedEncryptionTypes + +Value Type: REG_DWORD +Value: 0x7ffffff8 (2147483640) + +Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>WN12-SO-000065The system must be configured to prevent the storage of the LAN Manager hash of passwords.<VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3379SV-52892CCI-000196Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: NoLMHash + +Value Type: REG_DWORD +Value: 1SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>WN12-SO-000066The system must be configured to force users to log off when their allowed logon hours expire.<VulnDiscussion>Limiting logon hours can help protect data by only allowing access during specified times. This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, this must be enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-3380SV-52893CCI-001133Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Force logoff when logon hours expire" to "Enabled".Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. + +If the value for "Network security: Force logoff when logon hours expire" is not set to "Enabled", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000067The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.<VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to stand-alone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52865V-1153CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\ + +Value Name: LmCompatibilityLevel + +Value Type: REG_DWORD +Value: 5SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000068The system must be configured to the required LDAP client signing level.<VulnDiscussion>This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52894V-3381CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Services\LDAP\ + +Value Name: LDAPClientIntegrity + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000069The system must be configured to meet the minimum session security requirement for NTLM SSP-based clients.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52895V-3382CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinClientSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000070The system must be configured to meet the minimum session security requirement for NTLM SSP-based servers.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52922V-3666CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinServerSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000073The shutdown option must not be available from the logon dialog box.<VulnDiscussion>Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box ensures that individuals who shut down the system are authorized and tracked in the system's Security event log.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52840V-1075CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Shutdown: Allow system to be shutdown without having to log on" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ShutdownWithoutLogon + +Value Type: REG_DWORD +Value: 0SRG-OS-000396-GPOS-00176<GroupDescription></GroupDescription>WN12-SO-000074The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.<VulnDiscussion>This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52896V-3383CCI-002450Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ + +Value Name: Enabled + +Value Type: REG_DWORD +Value: 1 + +Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS, or the browser will not be able to connect to a secure site.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000075The system must be configured to require case insensitivity for non-Windows subsystems.<VulnDiscussion>This setting controls the behavior of non-Windows subsystems when dealing with the case of arguments or commands. Case sensitivity could lead to the access of files or commands that must be restricted. To prevent this from happening, case insensitivity restrictions must be required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52897V-3385CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Require case insensitivity for non-Windows subsystems" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Session Manager\Kernel\ + +Value Name: ObCaseInsensitive + +Value Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SO-000076The default permissions of global system objects must be increased.<VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing nonadministrative users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52877V-1173CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Session Manager\ + +Value Name: ProtectionMode + +Value Type: REG_DWORD +Value: 1SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN12-SO-000077User Account Control approval mode for the built-in Administrator must be enabled.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. + +Satisfies: SRG-OS-000373-GPOS-00158</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52946V-14234CCI-002038UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: FilterAdministratorToken + +Value Type: REG_DWORD +Value: 1SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000078User Account Control must, at minimum, prompt administrators for consent.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14235SV-52947CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent". + +More secure options for this setting would also be acceptable (e.g., Prompt for credentials, Prompt for consent (or credentials) on the secure desktop).UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorAdmin + +Value Type: REG_DWORD +Value: 4 (Prompt for consent) +3 (Prompt for credentials) +2 (Prompt for consent on the secure desktop) +1 (Prompt for credentials on the secure desktop)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN12-SO-000079User Account Control must automatically deny standard user requests for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. + +Satisfies: SRG-OS-000373-GPOS-00158</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52948V-14236CCI-002038UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorUser + +Value Type: REG_DWORD +Value: 0SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000080User Account Control must be configured to detect application installations and prompt for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14237SV-52949CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableInstallerDetection + +Value Type: REG_DWORD +Value: 1SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000081Windows must elevate all applications in User Account Control, not just signed ones.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures whether Windows elevates all applications, or only signed ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-16008SV-53142CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Only elevate executables that are signed and validated" to "Disabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ValidateAdminCodeSignatures + +Value Type: REG_DWORD +Value: 0SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000082User Account Control must only elevate UIAccess applications that are installed in secure locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14239SV-52950CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableSecureUIAPaths + +Value Type: REG_DWORD +Value: 1SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN12-SO-000083User Account Control must run all administrators in Admin Approval Mode, enabling UAC.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. + +Satisfies: SRG-OS-000373-GPOS-00158</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52951V-14240CCI-002038UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableLUA + +Value Type: REG_DWORD +Value: 1SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000084User Account Control must switch to the secure desktop when prompting for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting ensures that the elevation prompt is only used in secure desktop mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14241SV-52952CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Switch to the secure desktop when prompting for elevation" to "Enabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: PromptOnSecureDesktop + +Value Type: REG_DWORD +Value: 1SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000085User Account Control must virtualize file and registry write failures to per-user locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-14242SV-52953CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableVirtualization + +Value Type: REG_DWORD +Value: 1SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN12-SO-000086UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-15991SV-52223CCI-001084UAC requirements are NA on Server Core installations. + +Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled".UAC requirements are NA on Server Core installations. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableUIADesktopToggle + +Value Type: REG_DWORD +Value: 0SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-SO-000088Optional Subsystems must not be permitted to operate on the system.<VulnDiscussion>The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX Subsystem is required if the server supports applications that use that subsystem. The subsystem introduces a security risk relating to processes that can potentially persist across logins. That is, if a user starts a process and then logs out, there is a potential that the next user who logs in to the system could access the previous users process. This is dangerous because the process started by the first user may retain that users system privileges, and anything the second user does with that process will be performed with the privileges of the first user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-4445SV-52219CCI-000381Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System settings: Optional subsystems" to "Blank" (Configured with no entries).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Session Manager\Subsystems\ + +Value Name: Optional + +Value Type: REG_MULTI_SZ +Value: (Blank)SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-SO-000089The print driver installation privilege must be restricted to administrators.<VulnDiscussion>Allowing users to install drivers can introduce malware or cause the instability of a system. Print driver installation should be restricted to administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52214V-1151CCI-001812Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Prevent users from installing printer drivers" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\ + +Value Name: AddPrinterDrivers + +Value Type: REG_DWORD +Value: 1SRG-OS-000067-GPOS-00035<GroupDescription></GroupDescription>WN12-SO-000092Users must be required to enter a password to access private keys stored on the computer.<VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. + +The cornerstone of the PKI is the private key used to encrypt or digitally sign information. + +If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. + +Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-57639SV-72049CCI-000186Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ + +Value Name: ForceKeyProtection + +Type: REG_DWORD +Value: 2SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-SV-000100The Fax service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26600SV-52236CCI-000381Remove or disable the Fax (fax) service.Verify the Fax (fax) service is not installed or is disabled. + +Run "Services.msc". + +If the following is installed and not disabled, this is a finding: + +Fax (fax)SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN12-SV-000101The Microsoft FTP service must not be installed unless required.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26602SV-52237CCI-000382Remove or disable the "Microsoft FTP Service" (Service name: FTPSVC). + +To remove the "FTP Server" role from a system: +Start "Server Manager" +Select the server with the "FTP Server" role. +Scroll down to "ROLES AND FEATURES" in the left pane. +Select "Remove Roles and Features" from the drop down "TASKS" list. +Select the appropriate server on the "Server Selection" page, click "Next". +De-select "FTP Server" under "Web Server (IIS). +Click "Next" and "Remove" as prompted.If the server has the role of an FTP server, this is NA. + +Run "Services.msc". + +If the "Microsoft FTP Service" (Service name: FTPSVC) is installed and not disabled, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-SV-000103The Peer Networking Identity Manager service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26604SV-52238CCI-000381Remove or disable the Peer Networking Identity Manager (p2pimsvc) service.Verify the Peer Network Identity Manager (p2pimsvc) service is not installed or is disabled. + +Run "Services.msc". + +If the following is installed and not disabled, this is a finding: + +Peer Networking Identity Manager (p2pimsvc)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-SV-000104The Simple TCP/IP Services service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26605SV-52239CCI-000381Remove or disable the Simple TCP/IP Services (simptcp) service.Verify the Simple TCP/IP (simptcp) service is not installed or is disabled. + +Run "Services.msc". + +If the following is installed and not disabled, this is a finding: + +Simple TCP/IP Services (simptcp)SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN12-SV-000105The Telnet service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26606SV-52240CCI-000382Remove or disable the Telnet (tlntsvr) service.Verify the Telnet (tlntsvr) service is not installed or is disabled. + +Run "Services.msc". + +If the following is installed and not disabled, this is a finding: + +Telnet (tlntsvr)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-SV-000106The Smart Card Removal Policy service must be configured to automatic.<VulnDiscussion>The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52165V-40206CCI-000366Configure the Startup Type for the Smart Card Removal Policy service to "Automatic".Verify the Smart Card Removal Policy service is configured to "Automatic". + +Run "Services.msc". + +If the Startup Type for Smart Card Removal Policy is not set to Automatic, this is a finding.SRG-OS-000031-GPOS-00012<GroupDescription></GroupDescription>WN12-UC-000001A screen saver must be enabled on the system.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36656SV-51758CCI-000060Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Enable screen saver" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ + +Value Name: ScreenSaveActive + +Type: REG_SZ +Value: 1 + +Applications requiring continuous, real-time screen display (e.g., network management products) require the following and must be documented with the ISSO: + +-The logon session does not have administrator rights. +-The display station (e.g., keyboard, monitor, etc.) is located in a controlled access area.SRG-OS-000028-GPOS-00009<GroupDescription></GroupDescription>WN12-UC-000003The screen saver must be password protected.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51760V-36657CCI-000056Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Password protect the screen saver" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ + +Value Name: ScreenSaverIsSecure + +Type: REG_SZ +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-UC-000005Notifications from Windows Push Network Service must be turned off.<VulnDiscussion>The Windows Push Notification Service (WNS) allows third-party vendors to send updates for toasts, tiles, and badges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51762V-36776CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Notifications -> "Turn off notifications network usage" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\ + +Value Name: NoCloudApplicationNotification + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-UC-000006Toast notifications to the lock screen must be turned off.<VulnDiscussion>Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-36777SV-51763CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Notifications -> "Turn off toast notifications on the lock screen" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications\ + +Value Name: NoToastApplicationNotificationOnLockScreen + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-UC-000007The Windows Help Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting ensures the Windows Help Experience Improvement Program is disabled to prevent information from being passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53144V-16021CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Help Experience Improvement Program" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ + +Value Name: NoImplicitFeedback + +Type: REG_DWORD +Value: 1SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN12-UC-000008Windows Help Ratings feedback must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +This setting ensures users cannot provide ratings feedback to Microsoft for Help content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-16048SV-53145CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Help Ratings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ + +Value Name: NoExplicitFeedback + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-UC-000009Zone information must be preserved when saving attachments.<VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53002V-14268CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> "Do not preserve zone information in file attachments" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: SaveZoneInformation + +Type: REG_DWORD +Value: 2SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-UC-000010Mechanisms for removing zone information from file attachments must be hidden.<VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk. This setting prevents users from manually removing zone information from saved file attachments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53004V-14269CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> "Hide mechanisms to remove zone information" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: HideZoneInfoOnProperties + +Type: REG_DWORD +Value: 1SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN12-UC-000011The system must notify antivirus when file attachments are opened.<VulnDiscussion>Attaching malicious files is a known avenue of attack. This setting configures the system to notify antivirus programs when a user opens a file attachment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53006V-14270CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> "Notify antivirus programs when opening attachments" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: ScanWithAntiVirus + +Type: REG_DWORD +Value: 3SRG-OS-000480-GPOS-00228<GroupDescription></GroupDescription>WN12-UC-000012Users must be prevented from sharing files in their profiles.<VulnDiscussion>Allowing users to share files in their profiles may provide unauthorized access or result in the exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53140V-15727CCI-000366Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Network Sharing -> "Prevent users from sharing files within their profile" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoInPlaceSharing + +Type: REG_DWORD +Value: 1SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN12-UC-000013Media Player must be configured to prevent automatic Codec downloads.<VulnDiscussion>The Windows Media Player uses software components, referred to as Codecs, to play back media files. By default, when an unknown file type is opened with the Media Player, it will search the Internet for the appropriate Codec and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all Codecs must be installed by the System Administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52921V-3481CCI-001812Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> Playback -> "Prevent Codec Download" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ + +Value Name: PreventCodecDownload + +Type: REG_DWORD +Value: 1SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000001The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53120V-26469CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000002-MSThe Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on member servers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access this computer from the network" user right may access resources on the system, and must be limited to those that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51499V-26470CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to only include the following accounts or groups: + +Administrators +Authenticated UsersVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Access this computer from the network" user right, this is a finding: + +Administrators +Authenticated Users + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (V-36661) and required changes frequency (V-36662).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000003The Act as part of the operating system user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52108V-1102CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000005The Allow log on locally user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52110V-26472CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: + +Administrators + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000006-MSThe Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group and other approved groups.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-83319V-26473CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to only include the following accounts or groups: + +Administrators + +If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. + +Organizations may grant this to other groups, such as more restrictive groups with administrative or management functions, if required. Remote Desktop Services access must be restricted to the accounts that require it. This must be documented with the ISSO.Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding: + +Administrators + +If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. + +Organizations may grant this to other groups, such as more restrictive groups with administrative or management functions, if required. Remote Desktop Services access must be restricted to the accounts that require it. This must be documented with the ISSO.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000007The Back up files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52111V-26474CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding: + +Administrators + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000011The Create a pagefile user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53063V-26478CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: + +AdministratorsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000012The Create a token object user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52113V-26479CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create a token object" user right, this is a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000013The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52114V-26480CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to only include the following accounts or groups: + +Administrators +Service +Local Service +Network ServiceVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding: + +Administrators +Service +Local Service +Network Service + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000014The Create permanent shared objects user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53059V-26481CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000015The Create symbolic links user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53054V-26482CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to only include the following accounts or groups: + +Administrators + +Systems that have the Hyper-V role will also have "Virtual Machines" given this user right. If this needs to be added manually, enter it as "NT Virtual Machine\Virtual Machines".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding: + +Administrators + +Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines"). This is not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000016The Debug programs user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52115V-18010CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding: + +Administrators + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000017-MSThe Deny access to this computer from the network user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. + +Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51501V-1155CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: + +Domain Systems Only: +Enterprise Admins group +Domain Admins group +"Local account and member of Administrators group" or "Local account" (see Note below) + +All Systems: +Guests group + +Note: Windows Server 2012 R2 added new built-in security groups, "Local account" and "Local account and member of Administrators group". "Local account" is more restrictive but may cause issues on servers such as systems that provide Failover Clustering. +Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: + +Domain Systems Only: +Enterprise Admins group +Domain Admins group +"Local account and member of Administrators group" or "Local account" (see Note below) + +All Systems: +Guests group + +Note: Windows Server 2012 R2 added new built-in security groups, "Local account" and "Local account and member of Administrators group". "Local account" is more restrictive but may cause issues on servers such as systems that provide Failover Clustering. +Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000018-MSThe Deny log on as a batch job user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job such, as Task Scheduler. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. + +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26483SV-51502CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on as a batch job" to include the following: + +Domain Systems Only: +Enterprise Admins Group +Domain Admins Group + +All Systems: +Guests GroupVerify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: + +Domain Systems Only: +Enterprise Admins Group +Domain Admins Group + +All Systems: +Guests GroupSRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000019-MSThe Deny log on as a service user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a service" user right defines accounts that are denied log on as a service. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. + +Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51504V-26484CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on as a service" to include the following for domain-joined systems: + +Enterprise Admins Group +Domain Admins Group + +Configure the "Deny log on as a service" for nondomain systems to include no entries (blank).Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a service" user right on domain-joined systems, this is a finding: + +Enterprise Admins Group +Domain Admins Group + +If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000020-MSThe Deny log on locally user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51508V-26485CCI-000213Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on locally" to include the following: + +Domain Systems Only: +Enterprise Admins Group +Domain Admins Group + +All Systems: +Guests GroupVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: + +Domain Systems Only: +Enterprise Admins Group +Domain Admins Group + +All Systems: +Guests GroupSRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN12-UR-000021-MSThe Deny log on through Remote Desktop Services user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. + +Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51509V-26486CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: + +Domain Systems Only: +Enterprise Admins group +Domain Admins group +Local account (see Note below) + +All Systems: +Guests group + +Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. +Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: + +Domain Systems Only: +Enterprise Admins group +Domain Admins group +Local account (see Note below) + +All Systems: +Guests group + +Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. +Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000022-MSUnauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right on member servers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-51500V-26487CCI-002235Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Enable computer and user accounts to be trusted for delegation" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. + +If any accounts or groups are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000023The Force shutdown from a remote system user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53050V-26488CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: + +AdministratorsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000024The Generate security audits user right must only be assigned to Local Service and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52116V-26489CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Generate security audits" to only include the following accounts or groups: + +Local Service +Network ServiceVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding: + +Local Service +Network Service + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000025The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52117V-26490CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to only include the following accounts or groups: + +Administrators +Service +Local Service +Network ServiceVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: + +Administrators +Service +Local Service +Network Service + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000027The Increase scheduling priority user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52118V-26492CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Increase scheduling priority" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding: + +Administrators + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000028The Load and unload device drivers user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53043V-26493CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: + +AdministratorsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000029The Lock pages in memory user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52119V-26494CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN12-UR-000032The Manage auditing and security log user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214V-26496SV-53039CCI-000162CCI-000163CCI-000164CCI-000171CCI-001914Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding: + +Administrators + +If the organization has an Auditors group, the assignment of this group to the user right would not be a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000034The Modify firmware environment values user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53029V-26498CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to only include the following accounts or groups: + +Administrators +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: + +AdministratorsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000035The Perform volume maintenance tasks user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in data loss or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53025V-26499CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: + +AdministratorsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000036The Profile single process user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Profile single process" user right can monitor nonsystem processes performance. An attacker could potentially use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-53022V-26500CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: + +AdministratorsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000040The Restore files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52122V-26504CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding: + +Administrators + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN12-UR-000042The Take ownership of files or other objects user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows Server 2012-2012 R2 Member ServerDISADPMS TargetWindows Server 2012-2012 R2 Member Server4214SV-52123V-26506CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to only include the following accounts or groups: + +AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: + +Administrators + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). diff --git a/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_V2R19_Manual-xccdf.log b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_V2R19_Manual-xccdf.log deleted file mode 100644 index 409c2346b..000000000 --- a/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_V2R19_Manual-xccdf.log +++ /dev/null @@ -1,13 +0,0 @@ -V-2372::"Store password using reversible encryption"::"Store passwords using reversible encryption" -V-6836::"Minimum password length,"::"Minimum password length" -V-6840::*::HardCodedRule(AuditSettingRule)@{DscResource = 'AuditSetting'; DesiredValue = $true; Operator = '-eq'; Property = 'PasswordExpires'; Query = "SELECT * FROM Win32_UserAccount WHERE Disabled=$false AND LocalAccount=$true"} -V-7002::*::HardCodedRule(AuditSettingRule)@{DscResource = 'AuditSetting'; DesiredValue = $true; Operator = '-eq'; Property = 'PasswordRequired'; Query = "SELECT * FROM Win32_UserAccount WHERE Disabled=$false AND LocalAccount=$true"} -V-36707::Value: 0x00000001 (1) ::Value: 1 Or 2 -V-36736::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Certificate Revocation Checking service information'} -V-42420::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Firewall service information'} -V-80473::*::HardCodedRule(AuditSettingRule)@{DscResource = 'AuditSetting'; DesiredValue = '6.3.9600.17415'; Operator = '-ge'; Property = 'Version'; Query = "SELECT * FROM CIM_Datafile WHERE FileName='powershell' AND Path LIKE '%\\Windows\\System32\\WindowsPowerShell\\v1.0\\%' AND Extension='exe'"} -V-80475::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\::Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ -V-73805::*::HardCodedRule(WindowsFeatureRule)@{DscResource = 'WindowsFeature'; Ensure = 'Absent'; Name = 'SMB1Protocol'} -V-14235::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'ConsentPromptBehaviorAdmin'; ValueType = 'Dword'; ValueData = $null; OrganizationValueTestString = "'{0}' -le '4'"} -V-26359::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System'; ValueName = 'LegalNoticeCaption'; ValueType = 'String'; ValueData = $null; OrganizationValueTestString = "'{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$'"} -V-1089::confidential. See User::confidential. See User diff --git a/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_V2R19_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_V2R19_Manual-xccdf.xml deleted file mode 100644 index 9c1159ba9..000000000 --- a/source/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_MS_V2R19_Manual-xccdf.xml +++ /dev/null @@ -1,4116 +0,0 @@ -acceptedWindows Server 2012/2012 R2 Member Server Security Technical Implementation GuideThe Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.Developed_by_DISA_for_the_DoDDISASTIG.DOD.MILRelease: 19 Benchmark Date: 17 Jun 20202I - Mission Critical Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000010Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.<VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. - -If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000010Only administrators responsible for the domain controller must have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. - -System administrators must log on to systems using only accounts with the minimum level of authority necessary. - -Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the Administrators group to include only administrator groups or accounts that are responsible for the system. - -Remove any standard user accounts.This applies to domain controllers. A separate version applies to other systems. - -Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. - -Standard user accounts must not be members of the local administrator group. - -If prohibited accounts are members of the local administrators group, this is a finding. - -If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-MS-000010Only administrators responsible for the member server or standalone system must have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. - -System administrators must log on to systems using only accounts with the minimum level of authority necessary. - -For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group (see V-36433 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. - -Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the local "Administrators" group to include only administrator groups or accounts responsible for administration of the system. - -For domain-joined member servers, replace the Domain Admins group with a domain member server administrator group. - -Remove any standard user accounts.This applies to member servers and standalone systems. A separate version applies to domain controllers. - -Open "Computer Management". - -Navigate to "Groups" under "Local Users and Groups". - -Review the local "Administrators" group. - -Only administrator groups or accounts responsible for administration of the system may be members of the group. - -For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. - -Standard user accounts must not be members of the local Administrator group. - -If accounts that do not have responsibility for administration of the system are members of the local Administrators group, this is a finding. - -If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN16-00-000030Passwords for the built-in Administrator account must be changed at least every 60 days.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. - -Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000199Change the built-in Administrator account password at least every "60" days. - -Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this.Review the password last set date for the built-in Administrator account. - -Domain controllers: - -Open "PowerShell". - -Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet". - -If the "PasswordLastSet" date is greater than "60" days old, this is a finding. - -Member servers and standalone systems: - -Open "Command Prompt". - -Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. - -(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) - -If the "PasswordLastSet" date is greater than "60" days old, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000040Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.<VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. - -Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy require administrative accounts to not access the Internet or use applications such as email. - -The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. - -Whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Establish a policy, at minimum, to prohibit administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Ensure the policy is enforced. - -The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. - -If it does not, this is a finding. - -The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000050Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Ensure each member of the Backup Operators group has separate accounts for backup functions and standard user functions.If no accounts are members of the Backup Operators group, this is NA. - -Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. - -If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>WN16-00-000060Manually managed application account passwords must be at least 15 characters in length.<VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000205Establish a policy that requires application/service account passwords that are manually managed to be at least 15 characters in length. Ensure the policy is enforced.Determine if manually managed application/service accounts exist. If none exist, this is NA. - -Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. - -If such a policy does not exist or has not been implemented, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000070Manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.<VulnDiscussion>Setting application account passwords to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. - -It is recommended that system-managed service accounts be used whenever possible.Determine if manually managed application/service accounts exist. If none exist, this is NA. - -If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. - -Identify manually managed application/service accounts. - -To determine the date a password was last changed: - -Domain controllers: - -Open "PowerShell". - -Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. - -If the "PasswordLastSet" date is more than one year old, this is a finding. - -Member servers and standalone systems: - -Open "Command Prompt". - -Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. - -If the "Password Last Set" date is more than one year old, this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN16-00-000080Shared user accounts must not be permitted on the system.<VulnDiscussion>Shared accounts (accounts where two or more people log on with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000764Remove unapproved shared accounts from the system. - -Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.Determine whether any shared accounts exist. If no shared accounts exist, this is NA. - -Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. - -If unapproved shared accounts exist, this is a finding.SRG-OS-000370-GPOS-00155<GroupDescription></GroupDescription>WN16-00-000090Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.<VulnDiscussion>Using a whitelist provides a configuration management method to allow the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. - -The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001774Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. - -Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows Server. - -If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. - -Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: - -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmThis is applicable to unclassified systems. For other systems, this is NA. - -Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. - -If an application whitelisting program is not in use on the system, this is a finding. - -Configuration of whitelisting applications will vary by the program. - -AppLocker is a whitelisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. - -If AppLocker is used, perform the following to view the configuration of AppLocker: - -Open "PowerShell". - -If the AppLocker PowerShell module has not been imported previously, execute the following first: - -Import-Module AppLocker - -Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: - -Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml - -This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. - -Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: - -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000100Windows Server 2016 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.<VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. A number of system requirements must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Ensure domain-joined systems have a TPM that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) - -The TPM must be enabled in the firmware. - -Run "tpm.msc" for configuration options in Windows.For standalone systems, this is NA. - -Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. - -Verify the system has a TPM and it is ready for use. - -Run "tpm.msc". - -Review the sections in the center pane. - -"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". - -TPM Manufacturer Information - Specific Version = 2.0 or 1.2 - -If a TPM is not found or is not ready for use, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000110Systems must be maintained at a supported servicing level.<VulnDiscussion>Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Update the system to a Version 1607 (Build 14393.xxx) or greater.Open "Command Prompt". - -Enter "winver.exe". - -If the "About Windows" dialog box does not display "Microsoft Windows Server Version 1607 (Build 14393.xxx)" or greater, this is a finding. - -Preview versions must not be used in a production environment.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000120The Windows Server 2016 system must use an anti-virus program.<VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Install an anti-virus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. - -If there is no anti-virus solution installed on the system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000140Servers must have a host-based intrusion detection or prevention system.<VulnDiscussion>A properly configured Host-based Intrusion Detection System (HIDS) or Host-based Intrusion Prevention System (HIPS) provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Install a HIDS or HIPS on each server.Determine whether there is a HIDS or HIPS on each server. - -If the HIPS component of HBSS is installed and active on the host and the alerts of blocked activity are being logged and monitored, this meets the requirement. - -A HIDS device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the ISSO. - -If a HIDS is not installed on the system, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-00-000150Local volumes must use a format that supports NTFS attributes.<VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Format volumes to use NTFS or ReFS.Open "Computer Management". - -Select "Disk Management" under "Storage". - -For each local volume, if the file system does not indicate "NTFS", this is a finding. - -"ReFS" (resilient file system) is also acceptable and would not be a finding. - -This does not apply to system partitions such the Recovery and EFI System Partition.SRG-OS-000312-GPOS-00122<GroupDescription></GroupDescription>WN16-00-000160Permissions for the system drive root directory (usually C:\) must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. - -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002165Maintain the default permissions for the system drive's root directory and configure the Security Option "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN16-SO-000290). - -Default Permissions -C:\ -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -SYSTEM - Full control - This folder, subfolders, and files -Administrators - Full control - This folder, subfolders, and files -Users - Read & execute - This folder, subfolders, and files -Users - Create folders/append data - This folder and subfolders -Users - Create files/write data - Subfolders only -CREATOR OWNER - Full Control - Subfolders and files onlyThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) - -If permissions are not as restrictive as the default permissions listed below, this is a finding. - -Viewing in File Explorer: - -View the Properties of the system drive's root directory. - -Select the "Security" tab, and the "Advanced" button. - -Default permissions: -C:\ -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -SYSTEM - Full control - This folder, subfolders, and files -Administrators - Full control - This folder, subfolders, and files -Users - Read & execute - This folder, subfolders, and files -Users - Create folders/append data - This folder and subfolders -Users - Create files/write data - Subfolders only -CREATOR OWNER - Full Control - Subfolders and files only - -Alternately, use icacls: - -Open "Command Prompt (Admin)". - -Enter "icacls" followed by the directory: - -"icacls c:\" - -The following results should be displayed: - -c:\ -NT AUTHORITY\SYSTEM:(OI)(CI)(F) -BUILTIN\Administrators:(OI)(CI)(F) -BUILTIN\Users:(OI)(CI)(RX) -BUILTIN\Users:(CI)(AD) -BUILTIN\Users:(CI)(IO)(WD) -CREATOR OWNER:(OI)(CI)(IO)(F) -Successfully processed 1 files; Failed processing 0 filesSRG-OS-000312-GPOS-00122<GroupDescription></GroupDescription>WN16-00-000170Permissions for program file directories must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. - -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002165Maintain the default permissions for the program file directories and configure the Security Option "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN16-SO-000290). - -Default permissions: -\Program Files and \Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders, and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and filesThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) - -If permissions are not as restrictive as the default permissions listed below, this is a finding. - -Viewing in File Explorer: - -For each folder, view the Properties. - -Select the "Security" tab, and the "Advanced" button. - -Default permissions: -\Program Files and \Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files - -Alternately, use icacls: - -Open a Command prompt (admin). - -Enter "icacls" followed by the directory: - -'icacls "c:\program files"' -'icacls "c:\program files (x86)"' - -The following results should be displayed for each when entered: - -c:\program files (c:\program files (x86)) -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 filesSRG-OS-000312-GPOS-00122<GroupDescription></GroupDescription>WN16-00-000180Permissions for the Windows installation directory must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. - -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002165Maintain the default file ACLs and configure the Security Option "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN16-SO-000290). - -Default permissions: -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders, and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and filesThe default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) - -If permissions are not as restrictive as the default permissions listed below, this is a finding. - -Viewing in File Explorer: - -For each folder, view the Properties. - -Select the "Security" tab and the "Advanced" button. - -Default permissions: -\Windows -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders, and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files - -Alternately, use icacls: - -Open a Command prompt (admin). - -Enter "icacls" followed by the directory: - -"icacls c:\windows" - -The following results should be displayed for each when entered: - -c:\windows -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 filesSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-00-000190Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive. - -The default permissions of the higher-level keys are noted below. - -HKEY_LOCAL_MACHINE\SECURITY - -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -SYSTEM - Full Control - This key and subkeys -Administrators - Special - This key and subkeys - -HKEY_LOCAL_MACHINE\SOFTWARE - -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys - -HKEY_LOCAL_MACHINE\SYSTEM - -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - Subkeys only -ALL APPLICATION PACKAGES - Read - This key and subkeysReview the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. - -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. - -If permissions are not as restrictive as the default permissions listed below, this is a finding. - -Run "Regedit". - -Right-click on the registry areas noted below. - -Select "Permissions..." and the "Advanced" button. - -HKEY_LOCAL_MACHINE\SECURITY - -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -SYSTEM - Full Control - This key and subkeys -Administrators - Special - This key and subkeys - -HKEY_LOCAL_MACHINE\SOFTWARE - -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys - -HKEY_LOCAL_MACHINE\SYSTEM - -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - Subkeys only -ALL APPLICATION PACKAGES - Read - This key and subkeys - -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. - -If the defaults have not been changed, these are not a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-00-000200Non-administrative accounts or groups must only have print permissions on printer shares.<VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the permissions on shared printers to restrict standard users to only have Print permissions.Open "Devices and Printers". - -If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) - -For each printer: - -Right-click on the printer. - -Select "Printer Properties". - -Select the "Sharing" tab. - -If "Share this printer" is checked, select the "Security" tab. - -If any standard user accounts or groups have permissions other than "Print", this is a finding. - -The default is for the "Everyone" group to be given "Print" permission. - -"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN16-00-000210Outdated or unused accounts must be removed from the system or disabled.<VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed. - -Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000118-GPOS-00060</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000764CCI-000795Regularly review accounts to determine if they are still active. Remove or disable accounts that have not been used in the last 35 days.Open "Windows PowerShell". - -Domain Controllers: - -Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" - -This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. - -Member servers and standalone systems: - -Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) - -"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { - $user = ([ADSI]$_.Path) - $lastLogin = $user.Properties.LastLogin.Value - $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 - if ($lastLogin -eq $null) { - $lastLogin = 'Never' - } - Write-Host $user.Name $lastLogin $enabled -}" - -This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). -For example: User1 10/31/2015 5:49:56 AM True - -Review the list of accounts returned by the above queries to determine the finding validity for each account reported. - -Exclude the following accounts: - -- Built-in administrator account (Renamed, SID ending in 500) -- Built-in guest account (Renamed, Disabled, SID ending in 501) -- Built-in default account (Renamed, Disabled, SID ending in 503) -- Application accounts - -If any enabled accounts have not been logged on to within the past 35 days, this is a finding. - -Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN16-00-000220Windows Server 2016 accounts must require passwords.<VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000764Configure all enabled accounts to require passwords. - -The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.Review the password required status for enabled user accounts. - -Open "PowerShell". - -Domain Controllers: - -Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled". - -Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs). - -If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding. - -Member servers and standalone systems: - -Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. - -Exclude disabled accounts (e.g., DefaultAccount, Guest). - -If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN16-00-000230Passwords must be configured to expire.<VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000199Configure all enabled user account passwords to expire. - -Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone systems. Document any exceptions with the ISSO.Review the password never expires status for enabled user accounts. - -Open "PowerShell". - -Domain Controllers: - -Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". - -Exclude application accounts, disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. - -If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. - -Member servers and standalone systems: - -Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. - -Exclude application accounts and disabled accounts (e.g., DefaultAccount, Guest). - -If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.SRG-OS-000363-GPOS-00150<GroupDescription></GroupDescription>WN16-00-000240System files must be monitored for unauthorized changes.<VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001744Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. - -If system files are not monitored for unauthorized changes, this is a finding. - -A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN16-00-000250Non-system-created file shares on a system must limit access to groups that require it.<VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001090If a non-system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. - -Remove any unnecessary non-system-created shares.If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) - -Run "Computer Management". - -Navigate to System Tools >> Shared Folders >> Shares. - -Right-click any non-system-created shares. - -Select "Properties". - -Select the "Share Permissions" tab. - -If the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. - -Select the "Security" tab. - -If the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000270Software certificate installation files must be removed from Windows Server 2016.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. - -Note: This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files.Search all drives for *.p12 and *.pfx files. - -If any files with these extensions exist, this is a finding. - -This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.SRG-OS-000185-GPOS-00079<GroupDescription></GroupDescription>WN16-00-000280Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.<VulnDiscussion>This requirement addresses protection of user-generated data as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. - -Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). - -Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001199CCI-002475CCI-002476Configure systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data to employ encryption to protect the confidentiality and integrity of all information at rest.Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. - -If they do not, this is a finding.SRG-OS-000425-GPOS-00189<GroupDescription></GroupDescription>WN16-00-000290Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. - -Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. - -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPsec. - -Satisfies: SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002420CCI-002422Configure protection methods such as TLS, encrypted VPNs, or IPsec when the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been implemented. - -If protection methods have not been implemented, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000300The roles and features required by the system must be documented.<VulnDiscussion>Unnecessary roles and features increase the attack surface of a system. Limiting roles and features of a system to only those necessary reduces this potential. The standard installation option (previously called Server Core) further reduces this when selected at installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Document the roles and features required for the system to operate. Uninstall any that are not required.Required roles and features will vary based on the function of the individual system. - -Roles and features specifically required to be disabled per the STIG are identified in separate requirements. - -If the organization has not documented the roles and features required for the system(s), this is a finding. - -The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State".SRG-OS-000480-GPOS-00231<GroupDescription></GroupDescription>WN16-00-000310A host-based firewall must be installed and enabled on the system.<VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366CCI-002080Install and enable a host-based firewall on the system.Determine if a host-based firewall is installed and enabled on the system. - -If a host-based firewall is not installed and enabled on the system, this is a finding. - -The configuration requirements will be determined by the applicable firewall STIG.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN16-00-000320Windows Server 2016 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Host Based Security System (HBSS) is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001233Install a DoD approved HBSS software and ensure it is operating continuously.Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. - -If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.SRG-OS-000002-GPOS-00002<GroupDescription></GroupDescription>WN16-00-000330Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours.<VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. - -Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. - -If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. - -To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000016Configure temporary user accounts to automatically expire within 72 hours. - -Domain accounts can be configured with an account expiration date, under "Account" properties. - -Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account. - -Delete any temporary user accounts that are no longer necessary.Review temporary user accounts for expiration dates. - -Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. - -Domain Controllers: - -Open "PowerShell". - -Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". - -If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding. - -Member servers and standalone systems: - -Open "Command Prompt". - -Run "Net user [username]", where [username] is the name of the temporary user account. - -If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.SRG-OS-000123-GPOS-00064<GroupDescription></GroupDescription>WN16-00-000340Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.<VulnDiscussion>Emergency administrator accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. - -Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. - -To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001682Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours. - -Domain accounts can be configured with an account expiration date, under "Account" properties. - -Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account.Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. - -If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. - -If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. - -Domain Controllers: - -Open "PowerShell". - -Enter "Search-ADAccount –AccountExpiring | FT Name, AccountExpirationDate". - -If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. - -Member servers and standalone systems: - -Open "Command Prompt". - -Run "Net user [username]", where [username] is the name of the emergency account. - -If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000350The Fax Server role must not be installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Uninstall the "Fax Server" role. - -Start "Server Manager". - -Select the server with the role. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "Fax Server" on the "Roles" page. - -Click "Next" and "Remove" as prompted.Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq Fax". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN16-00-000360The Microsoft FTP service must not be installed unless required.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000382Uninstall the "FTP Server" role. - -Start "Server Manager". - -Select the server with the role. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "FTP Server" under "Web Server (IIS)" on the "Roles" page. - -Click "Next" and "Remove" as prompted.If the server has the role of an FTP server, this is NA. - -Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq Web-Ftp-Service". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding. - -If the system has the role of an FTP server, this must be documented with the ISSO.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000370The Peer Name Resolution Protocol must not be installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Uninstall the "Peer Name Resolution Protocol" feature. - -Start "Server Manager". - -Select the server with the feature. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "Peer Name Resolution Protocol" on the "Features" page. - -Click "Next" and "Remove" as prompted.Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq PNRP". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000380Simple TCP/IP Services must not be installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Uninstall the "Simple TCP/IP Services" feature. - -Start "Server Manager". - -Select the server with the feature. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "Simple TCP/IP Services" on the "Features" page. - -Click "Next" and "Remove" as prompted.Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq Simple-TCPIP". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN16-00-000390The Telnet Client must not be installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000382Uninstall the "Telnet Client" feature. - -Start "Server Manager". - -Select the server with the feature. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "Telnet Client" on the "Features" page. - -Click "Next" and "Remove" as prompted.Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq Telnet-Client". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000400The TFTP Client must not be installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Uninstall the "TFTP Client" feature. - -Start "Server Manager". - -Select the server with the feature. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "TFTP Client" on the "Features" page. - -Click "Next" and "Remove" as prompted.Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq TFTP-Client". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000410The Server Message Block (SMB) v1 protocol must be uninstalled.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Uninstall the SMBv1 protocol. - -Open "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Uninstall-WindowsFeature -Name FS-SMB1 -Restart". -(Omit the Restart parameter if an immediate restart of the system cannot be done.) - -Alternately: - -Start "Server Manager". - -Select the server with the feature. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "SMB 1.0/CIFS File Sharing Support" on the "Features" page. - -Click "Next" and "Remove" as prompted.Different methods are available to disable SMBv1 on Windows 2016. This is the preferred method, however if V-78123 and V-78125 are configured, this is NA. - -Open "Windows PowerShell" with elevated privileges (run as administrator). - -Enter "Get-WindowsFeature -Name FS-SMB1". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000420Windows PowerShell 2.0 must not be installed.<VulnDiscussion>Windows PowerShell 5.0 added advanced logging features that can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Uninstall the "Windows PowerShell 2.0 Engine". - -Start "Server Manager". - -Select the server with the feature. - -Scroll down to "ROLES AND FEATURES" in the right pane. - -Select "Remove Roles and Features" from the drop-down "TASKS" list. - -Select the appropriate server on the "Server Selection" page and click "Next". - -Deselect "Windows PowerShell 2.0 Engine" under "Windows PowerShell" on the "Features" page. - -Click "Next" and "Remove" as prompted.Open "PowerShell". - -Enter "Get-WindowsFeature | Where Name -eq PowerShell-v2". - -If "Installed State" is "Installed", this is a finding. - -An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000430FTP servers must be configured to prevent anonymous logons.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. - -Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the FTP service to prevent anonymous logons. - -Open "Internet Information Services (IIS) Manager". - -Select the server. - -Double-click "FTP Authentication". - -Select "Anonymous Authentication". - -Select "Disabled" under "Actions".If FTP is not installed on the system, this is NA. - -Open "Internet Information Services (IIS) Manager". - -Select the server. - -Double-click "FTP Authentication". - -If the "Anonymous Authentication" status is "Enabled", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000440FTP servers must be configured to prevent access to the system drive.<VulnDiscussion>The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the FTP sites to allow access only to specific FTP shared resources. Do not allow access to other areas of the system.If FTP is not installed on the system, this is NA. - -Open "Internet Information Services (IIS) Manager". - -Select "Sites" under the server name. - -For any sites with a Binding that lists FTP, right-click the site and select "Explore". - -If the site is not defined to a specific folder for shared FTP resources, this is a finding. - -If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding.SRG-OS-000355-GPOS-00143<GroupDescription></GroupDescription>WN16-00-000450The time service must synchronize with an appropriate DoD time source.<VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001891Configure the system to synchronize time with an appropriate DoD time source. - -Domain-joined systems use NT5DS to synchronize time from other systems in the domain by default. - -If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an appropriate DoD time server. - -The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.Review the Windows time service configuration. - -Open an elevated "Command Prompt" (run as administrator). - -Enter "W32tm /query /configuration". - -Domain-joined systems (excluding the domain controller with the PDC emulator role): - -If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding. - -Other systems: - -If systems are configured with a "Type" of "NTP", including standalone systems and the domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. - -To determine the domain controller with the PDC Emulator role: - -Open "PowerShell". - -Enter "Get-ADDomain | FT PDCEmulator".SRG-OS-000329-GPOS-00128<GroupDescription></GroupDescription>WN16-AC-000010Windows 2016 account lockout duration must be configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. - -A value of "0" is also acceptable, requiring an administrator to unlock the account.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "LockoutDuration" is less than "15" (excluding "0") in the file, this is a finding. - -Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.SRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>WN16-AC-000020Windows Server 2016 must have the number of allowed bad logon attempts configured to three or less.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack while allowing for honest errors made during normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000044Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or fewer invalid logon attempts (excluding "0", which is unacceptable).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "LockoutBadCount" equals "0" or is greater than "3" in the file, this is a finding.SRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>WN16-AC-000030Windows Server 2016 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system. - -Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000044CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. - -If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "ResetLockoutCount" is less than "15" in the file, this is a finding.SRG-OS-000077-GPOS-00045<GroupDescription></GroupDescription>WN16-AC-000040Windows Server 2016 password history must be configured to 24 passwords remembered.<VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is "24" for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000200Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "PasswordHistorySize" is less than "24" in the file, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN16-AC-000050Windows Server 2016 maximum password age must be configured to 60 days or less.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000199Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum password age" to "60" days or less (excluding "0", which is unacceptable).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for the "Maximum password age" is greater than "60" days, this is a finding. - -If the value is set to "0" (never expires), this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "MaximumPasswordAge" is greater than "60" or equal to "0" in the file, this is a finding.SRG-OS-000075-GPOS-00043<GroupDescription></GroupDescription>WN16-AC-000060Windows Server 2016 minimum password age must be configured to at least one day.<VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000198Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password age" to at least "1" day.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately"), this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "MinimumPasswordAge" equals "0" in the file, this is a finding.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>WN16-AC-000070Windows Server 2016 minimum password length must be configured to 14 characters.<VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000205Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters.Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for the "Minimum password length," is less than "14" characters, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "MinimumPasswordLength" is less than "14" in the file, this is a finding.SRG-OS-000069-GPOS-00037<GroupDescription></GroupDescription>WN16-AC-000080Windows Server 2016 must have the built-in Windows password complexity policy enabled.<VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least three of the four types of characters (numbers, upper- and lower-case letters, and special characters) and prevents the inclusion of user names or parts of user names. - -Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000266-GPOS-00101</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000192CCI-000193CCI-000194CCI-001619Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "PasswordComplexity" equals "0" in the file, this is a finding. - -Note: If an external password filter is in use that enforces all four character types and requires this setting to be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>WN16-AC-000090Windows Server 2016 reversible password encryption must be disabled.<VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords, which are easily compromised. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000196Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. - -If the value for "Store passwords using reversible encryption" is not set to "Disabled", this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "ClearTextPassword" equals "1" in the file, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN16-DC-000020Kerberos user logon restrictions must be enforced.<VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. - -Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Enforce user logon restrictions" to "Enabled".This applies to domain controllers. It is NA for other systems. - -Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". - -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). - -Right-click on the "Default Domain Policy". - -Select "Edit". - -Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. - -If the "Enforce user logon restrictions" is not set to "Enabled", this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN16-DC-000030The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.<VulnDiscussion>This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection. - -Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for service ticket" to a maximum of "600" minutes, but not "0", which equates to "Ticket doesn't expire".This applies to domain controllers. It is NA for other systems. - -Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". - -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). - -Right-click on the "Default Domain Policy". - -Select "Edit". - -Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. - -If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN16-DC-000040The Kerberos user ticket lifetime must be limited to 10 hours or less.<VulnDiscussion>In Kerberos, there are two types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user's initial authentication to the domain controller results in a TGT, which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that start up under a specified user account, users must always get a TGT first and then get Service Tickets to all computers and services accessed. - -Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket" to a maximum of "10" hours but not "0", which equates to "Ticket doesn't expire".This applies to domain controllers. It is NA for other systems. - -Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". - -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). - -Right-click on the "Default Domain Policy". - -Select "Edit". - -Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. - -If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN16-DC-000050The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.<VulnDiscussion>This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access. - -Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket renewal" to a maximum of "7" days or less.This applies to domain controllers. It is NA for other systems. - -Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". - -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). - -Right-click on the "Default Domain Policy". - -Select "Edit". - -Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. - -If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN16-DC-000060The computer clock synchronization tolerance must be limited to 5 minutes or less.<VulnDiscussion>This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. In order to prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible. - -Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum tolerance for computer clock synchronization" to a maximum of "5" minutes or less.This applies to domain controllers. It is NA for other systems. - -Verify the following is configured in the Default Domain Policy. - -Open "Group Policy Management". - -Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). - -Right-click on the "Default Domain Policy". - -Select "Edit". - -Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. - -If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000070Permissions on the Active Directory data files must only allow System and Administrators access.<VulnDiscussion>Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Maintain the permissions on NTDS database and log files as follows: - -NT AUTHORITY\SYSTEM:(I)(F) -BUILTIN\Administrators:(I)(F) - -(I) - permission inherited from parent container -(F) - full accessThis applies to domain controllers. It is NA for other systems. - -Run "Regedit". - -Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". - -Note the directory locations in the values for: - -Database log files path -DSA Database file - -By default, they will be \Windows\NTDS. - -If the locations are different, the following will need to be run for each. - -Open "Command Prompt (Admin)". - -Navigate to the NTDS directory (\Windows\NTDS by default). - -Run "icacls *.*". - -If the permissions on each file are not as restrictive as the following, this is a finding. - -NT AUTHORITY\SYSTEM:(I)(F) -BUILTIN\Administrators:(I)(F) - -(I) - permission inherited from parent container -(F) - full accessSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000080The Active Directory SYSVOL directory must have the proper access control permissions.<VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. - -The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Maintain the permissions on the SYSVOL directory. Do not allow greater than "Read & execute" permissions for standard user accounts or groups. The defaults below meet this requirement. - -C:\Windows\SYSVOL -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -Authenticated Users - Read & execute - This folder, subfolder, and files -Server Operators - Read & execute- This folder, subfolder, and files -Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) -CREATOR OWNER - Full control - Subfolders and files only -Administrators - Full control - Subfolders and files only -SYSTEM - Full control - This folder, subfolders, and filesThis applies to domain controllers. It is NA for other systems. - -Open a command prompt. - -Run "net share". - -Make note of the directory location of the SYSVOL share. - -By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. - -If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. - -The default permissions noted below meet this requirement. - -Open "Command Prompt". - -Run "icacls c:\Windows\SYSVOL". - -The following results should be displayed: - -NT AUTHORITY\Authenticated Users:(RX) -NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) -BUILTIN\Server Operators:(RX) -BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) -BUILTIN\Administrators:(M,WDAC,WO) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(F) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M,WDAC,WO) -CREATOR OWNER:(OI)(CI)(IO)(F) - -(RX) - Read & execute - -Run "icacls /help" to view definitions of other permission codes. - -Alternately, open "File Explorer". - -Navigate to \Windows\SYSVOL (or the directory noted previously if different). - -Right-click the directory and select properties. - -Select the "Security" tab and click "Advanced". - -Default permissions: - -C:\Windows\SYSVOL -Type - "Allow" for all -Inherited from - "None" for all - -Principal - Access - Applies to - -Authenticated Users - Read & execute - This folder, subfolder, and files -Server Operators - Read & execute- This folder, subfolder, and files -Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) -CREATOR OWNER - Full control - Subfolders and files only -Administrators - Full control - Subfolders and files only -SYSTEM - Full control - This folder, subfolders, and filesSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000090Active Directory Group Policy objects must have proper access control permissions.<VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems relying on the directory service. - -For Active Directory (AD), the Group Policy objects require special attention. In a distributed administration model (i.e., help desk), Group Policy objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for Group Policy objects, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Maintain the permissions on Group Policy objects to not allow greater than "Read" and "Apply group policy" for standard user accounts or groups. The default permissions below meet this requirement. - -Authenticated Users - Read, Apply group policy, Special permissions - -The special permissions for Authenticated Users are for Read-type Properties. - -CREATOR OWNER - Special permissions -SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions -Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions -Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -Document any other access permissions that allow the objects to be updated with the ISSO. - -The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on created Group Policy objects.This applies to domain controllers. It is NA for other systems. - -Review the permissions on Group Policy objects. - -Open "Group Policy Management" (available from various menus or run "gpmc.msc"). - -Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). - -For each Group Policy object: - -Select the Group Policy object item in the left pane. - -Select the "Delegation" tab in the right pane. - -Select the "Advanced" button. - -Select each Group or user name. - -View the permissions. - -If any standard user accounts or groups have "Allow" permissions greater than "Read" and "Apply group policy", this is a finding. - -Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO. - -The default permissions noted below satisfy this requirement. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next "Advanced" button, the desired Permission entry, and the "Edit" button. - -Authenticated Users - Read, Apply group policy, Special permissions - -The special permissions for Authenticated Users are for Read-type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -The special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties. - -CREATOR OWNER - Special permissions -SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions -Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions -Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000100The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.<VulnDiscussion>When Active Directory objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes that could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Limit the permissions on the Domain Controllers OU to restrict changes to System, Domain Admins, Enterprise Admins and Administrators. - -The default permissions listed below satisfy this requirement. - -Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions. - -CREATOR OWNER - Special permissions - -SELF - Special permissions - -Authenticated Users - Read, Special permissions - -The special permissions for Authenticated Users are Read types. - -SYSTEM - Full Control - -Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The special permissions for Pre-Windows 2000 Compatible Access are Read types. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsThis applies to domain controllers. It is NA for other systems. - -Review the permissions on the Domain Controllers OU. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Select "Advanced Features" in the "View" menu if not previously selected. - -Select the "Domain Controllers" OU (folder in folder icon). - -Right-click and select "Properties". - -Select the "Security" tab. - -If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. - -The default permissions listed below satisfy this requirement. - -Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -SELF - Special permissions - -Authenticated Users - Read, Special permissions - -The special permissions for Authenticated Users are Read types. - -If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are Read types. - -If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000110Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions.<VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Maintain the permissions on domain-defined OUs to be at least as restrictive as the defaults below. - -Document any additional permissions above Read with the ISSO if an approved distributed administration model (help desk or other user support staff) is implemented. - -CREATOR OWNER - Special permissions - -Self - Special permissions - -Authenticated Users - Read, Special permissions - -The special permissions for Authenticated Users are Read type. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The special permissions for Pre-Windows 2000 Compatible Access are for Read types. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsThis applies to domain controllers. It is NA for other systems. - -Review the permissions on domain-defined OUs. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: - -Right-click the OU and select "Properties". - -Select the "Security" tab. - -If the permissions on the OU are not at least as restrictive as those below, this is a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -Self - Special permissions - -Authenticated Users - Read, Special permissions - -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. - -If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). - -If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs).SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN16-DC-000120Data files owned by users must be on a different logical partition from the directory server data files.<VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. - -The directory service may be vulnerable to a denial of service attack when user-owned files on a common partition are expanded to an extent preventing the directory service from acquiring more space for directory or audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001090Move shares used to store files owned by users to a different logical partition than the directory server data files.This applies to domain controllers. It is NA for other systems. - -Run "Regedit". - -Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". - -Note the directory locations in the values for "DSA Database file". - -Open "Command Prompt". - -Enter "net share". - -Note the logical drive(s) or file system partition for any organization-created data shares. - -Ignore system shares (e.g., NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored. - -If user shares are located on the same logical partition as the directory server data files, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-DC-000130Domain controllers must run on a machine dedicated to that function.<VulnDiscussion>Executing application servers on the same host machine with a directory server may substantially weaken the security of the directory server. Web or database server applications usually require the addition of many programs and accounts, increasing the attack surface of the computer. - -Some applications require the addition of privileged accounts, providing potential sources of compromise. Some applications (such as Microsoft Exchange) may require the use of network ports or services conflicting with the directory server. In this case, non-standard ports might be selected, and this could interfere with intrusion detection or prevention services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Remove additional roles or applications such as web, database, and email from the domain controller.This applies to domain controllers, It is NA for other systems. - -Review the installed roles the domain controller is supporting. - -Start "Server Manager". - -Select "AD DS" in the left pane and the server name under "Servers" to the right. - -Select "Add (or Remove) Roles and Features" from "Tasks" in the "Roles and Features" section. (Cancel before any changes are made.) - -Determine if any additional server roles are installed. A basic domain controller setup will include the following: - -- Active Directory Domain Services -- DNS Server -- File and Storage Services - -If any roles not requiring installation on a domain controller are installed, this is a finding. - -A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements. - -Run "Programs and Features". - -Review installed applications. - -If any applications are installed that are not required for the domain controller, this is a finding.SRG-OS-000396-GPOS-00176<GroupDescription></GroupDescription>WN16-DC-000140Separate, NSA-approved (Type 1) cryptography must be used to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.<VulnDiscussion>Directory data that is not appropriately encrypted is subject to compromise. Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002450Configure NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level that transfer replication data through a network cleared to a lower level than the data.This applies to domain controllers. It is NA for other systems. - -Review the organization network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted. - -Determine the classification level of the Windows domain controller. - -If the classification level of the Windows domain controller is higher than the level of the networks, review the organization network diagram(s) and directory implementation documentation to determine if NSA-approved encryption is used to protect the replication network traffic. - -If the classification level of the Windows domain controller is higher than the level of the network traversed and NSA-approved encryption is not used, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-DC-000150Directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access.<VulnDiscussion>To the extent that anonymous access to directory data (outside the root DSE) is permitted, read access control of the data is effectively disabled. If other means of controlling access (such as network restrictions) are compromised, there may be nothing else to protect the confidentiality of sensitive directory data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure directory data (outside the root DSE) of a non-public directory to prevent anonymous access. - -For AD, there are multiple configuration items that could enable anonymous access. - -Changing the access permissions on the domain naming context object (from the secure defaults) could enable anonymous access. If the check procedures indicate this is the cause, the process that was used to change the permissions should be reversed. This could have been through the Windows Support Tools ADSI Edit console (adsiedit.msc). - -The dsHeuristics option is used. This is addressed in check V-8555 in the AD Forest STIG.This applies to domain controllers. It is NA for other systems. - -Open "Command Prompt" (not elevated). - -Run "ldp.exe". - -From the "Connection menu", select "Bind". - -Clear the User, Password, and Domain fields. - -Select "Simple bind" for the Bind type and click "OK". - -Confirmation of anonymous access will be displayed at the end: - -res = ldap_simple_bind_s -Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON' - -From the "Browse" menu, select "Search". - -In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field. - -Clear the Attributes field and select "Run". - -Error messages should display related to Bind and user not authenticated. - -If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding. - -The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access. - -Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. - -Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>WN16-DC-000160The directory service must be configured to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity.<VulnDiscussion>The failure to terminate inactive network connections increases the risk of a successful attack on the directory server. The longer an established session is in progress, the more time an attacker has to hijack the session, implement a means to passively intercept data, or compromise any protections on client access. For example, if an attacker gains control of a client computer, an existing (already authenticated) session with the directory server could allow access to the directory. The lack of confidentiality protection in LDAP-based sessions increases exposure to this vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001133Configure the directory service to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity. - -Open an elevated "Command prompt" (run as administrator). - -Enter "ntdsutil". - -At the "ntdsutil:" prompt, enter "LDAP policies". - -At the "ldap policy:" prompt, enter "connections". - -At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller). - -At the "server connections:" prompt, enter "q". - -At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to 300". - -Enter "Commit Changes" to save. - -Enter "Show values" to verify changes. - -Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.This applies to domain controllers. It is NA for other systems. - -Open an elevated "Command Prompt" (run as administrator). - -Enter "ntdsutil". - -At the "ntdsutil:" prompt, enter "LDAP policies". - -At the "ldap policy:" prompt, enter "connections". - -At the "server connections:" prompt, enter "connect to server [host-name]" -(where [host-name] is the computer name of the domain controller). - -At the "server connections:" prompt, enter "q". - -At the "ldap policy:" prompt, enter "show values". - -If the value for MaxConnIdleTime is greater than "300" (5 minutes) or is not specified, this is a finding. - -Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. - -Alternately, Dsquery can be used to display MaxConnIdleTime: - -Open "Command Prompt (Admin)". -Enter the following command (on a single line). - -dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits - -The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil). - -If the results do not specify a "MaxConnIdleTime" or it has a value greater than "300" (5 minutes), this is a finding.SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000170Active Directory Group Policy objects must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes Group Policy objects. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the audit settings for Group Policy objects to include the following. - -This can be done at the Policy level in Active Directory to apply to all group policies. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Select "Advanced Features" from the "View" Menu. - -Navigate to [Domain] >> System >> Policies in the left panel. - -Right click "Policies", select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button. - -Select the "Auditing" tab. - -Type - Fail -Principal - Everyone -Access - Full Control -Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects - -The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. - -Type - Success -Principal - Everyone -Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) -Inherited from - Parent Object -Applies to - Descendant groupPolicyContainer objects - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) -Inherited from - Parent Object -Applies to - Descendant Organization Unit ObjectsThis applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for all Group Policy objects. - -Open "Group Policy Management" (available from various menus or run "gpmc.msc"). - -Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). - -For each Group Policy object: - -Select the Group Policy object item in the left pane. - -Select the "Delegation" tab in the right pane. - -Select the "Advanced" button. - -Select the "Advanced" button again and then the "Auditing" tab. - -If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects - -The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. - -Type - Success -Principal - Everyone -Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) -Inherited from - Parent Object -Applies to - Descendant groupPolicyContainer objects - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) -Inherited from - Parent Object -Applies to - Descendant Organization Unit ObjectsSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000180The Active Directory Domain object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the domain being reviewed in the left pane. - -Right-click the domain name and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -Configure the audit settings for Domain object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special - -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner.)This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the Domain object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the domain being reviewed in the left pane. - -Right-click the domain name and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special - -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner)SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000190The Active Directory Infrastructure object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the domain being reviewed in the left pane. - -Right-click the "Infrastructure" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -Configure the audit settings for Infrastructure object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for Infrastructure object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the domain being reviewed in the left pane. - -Right-click the "Infrastructure" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000200The Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the "Domain Controllers OU" under the domain being reviewed in the left pane. - -Right-click the "Domain Controllers OU" object and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -Configure the audit settings for Domain Controllers OU object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsThis applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the Domain Controller OU object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the "Domain Controllers OU" under the domain being reviewed in the left pane. - -Right-click the "Domain Controllers OU" object and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object and all descendant objects - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000210The Active Directory AdminSDHolder object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select "System" under the domain being reviewed in the left pane. - -Right-click the "AdminSDHolder" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -Configure the audit settings for AdminSDHolder object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsThis applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the "AdminSDHolder" object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select "System" under the domain being reviewed in the left pane. - -Right-click the "AdminSDHolder" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objectsSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000220The Active Directory RID Manager$ object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select "System" under the domain being reviewed in the left pane. - -Right-click the "RID Manager$" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -Configure the audit settings for RID Manager$ object to include the following. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the "RID Manager$" object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select "System" under the domain being reviewed in the left pane. - -Right-click the "RID Manager$" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain)SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>WN16-AU-000010Audit records must be backed up to a different system or media than the system being audited.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001851Establish and implement a process for backing up log data to another system or media other than the system being audited.Determine if a process to back up log data to a different system or media than the system being audited has been implemented. - -If it has not, this is a finding.SRG-OS-000479-GPOS-00224<GroupDescription></GroupDescription>WN16-AU-000020Windows Server 2016 must, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001851Configure the system to, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. - -If they are not, this is a finding.SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN16-AU-000030Permissions for the Application event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied. - -Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000162CCI-000163CCI-000164Configure the permissions on the Application event log file (Application.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\ System32\winevt\Logs" folder. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Navigate to the Application event log file. - -The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. - -If the permissions for the "Application.evtx" file are not as restrictive as the default permissions listed below, this is a finding. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full ControlSRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN16-AU-000040Permissions for the Security event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied. - -Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000162CCI-000163CCI-000164Configure the permissions on the Security event log file (Security.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\ System32\winevt\Logs" folder. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Navigate to the Security event log file. - -The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. - -If the permissions for the "Security.evtx" file are not as restrictive as the default permissions listed below, this is a finding. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full ControlSRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN16-AU-000050Permissions for the System event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied. - -Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000162CCI-000163CCI-000164Configure the permissions on the System event log file (System.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control - -The default location is the "%SystemRoot%\ System32\winevt\Logs" folder. - -If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Navigate to the System event log file. - -The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. - -If the permissions for the "System.evtx" file are not as restrictive as the default permissions listed below, this is a finding. - -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full ControlSRG-OS-000257-GPOS-00098<GroupDescription></GroupDescription>WN16-AU-000060Event Viewer must be protected from unauthorized modification and deletion.<VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. - -Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools. - -Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001494CCI-001495Configure the permissions on the "Eventvwr.exe" file to prevent modification by any groups or accounts other than TrustedInstaller. The default permissions listed below satisfy this requirement: - -TrustedInstaller - Full Control -Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute - -The default location is the "%SystemRoot%\ System32" folder.Navigate to "%SystemRoot%\System32". - -View the permissions on "Eventvwr.exe". - -If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a finding. - -The default permissions below satisfy this requirement: - -TrustedInstaller - Full Control -Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & ExecuteSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN16-AU-000070Windows Server 2016 must be configured to audit Account Logon - Credential Validation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Logon >> Credential Validation - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN16-AU-000080Windows Server 2016 must be configured to audit Account Logon - Credential Validation failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Logon >> Credential Validation - FailureSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN16-DC-000230Windows Server 2016 must be configured to audit Account Management - Computer Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Computer Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling computer accounts. - -Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Computer Account Management" with "Success" selected.This applies to domain controllers. It is NA for other systems. - -Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Management >> Computer Account Management - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000100Windows Server 2016 must be configured to audit Account Management - Other Account Management Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Other Account Management Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Management >> Other Account Management Events - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN16-AU-000120Windows Server 2016 must be configured to audit Account Management - Security Group Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members. - -Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Management >> Security Group Management - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN16-AU-000140Windows Server 2016 must be configured to audit Account Management - User Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. - -Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Management >> User Account Management - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN16-AU-000150Windows Server 2016 must be configured to audit Account Management - User Account Management failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. - -Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Account Management >> User Account Management - FailureSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN16-AU-000160Windows Server 2016 must be configured to audit Detailed Tracking - Plug and Play Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Detailed Tracking >> Plug and Play Events - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000170Windows Server 2016 must be configured to audit Detailed Tracking - Process Creation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Process Creation records events related to the creation of a process and the source. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Detailed Tracking >> Process Creation - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000240Windows Server 2016 must be configured to audit DS Access - Directory Service Access successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Directory Service Access records events related to users accessing an Active Directory object. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Access" with "Success" selected.This applies to domain controllers. It is NA for other systems. - -Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -DS Access >> Directory Service Access - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000250Windows Server 2016 must be configured to audit DS Access - Directory Service Access failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Directory Service Access records events related to users accessing an Active Directory object. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Access" with "Failure" selected.This applies to domain controllers. It is NA for other systems. - -Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -DS Access >> Directory Service Access - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000260Windows Server 2016 must be configured to audit DS Access - Directory Service Changes successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Changes" with "Success" selected.This applies to domain controllers. It is NA for other systems. - -Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -DS Access >> Directory Service Changes - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-DC-000270Windows Server 2016 must be configured to audit DS Access - Directory Service Changes failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Changes" with "Failure" selected.This applies to domain controllers. It is NA for other systems. - -Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -DS Access >> Directory Service Changes - FailureSRG-OS-000240-GPOS-00090<GroupDescription></GroupDescription>WN16-AU-000220Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Account Lockout events can be used to identify potentially malicious logon attempts. - -Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Account Lockout - SuccessSRG-OS-000240-GPOS-00090<GroupDescription></GroupDescription>WN16-AU-000230Windows Server 2016 must be configured to audit Logon/Logoff - Account Lockout failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Account Lockout events can be used to identify potentially malicious logon attempts. - -Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. - -Logon/Logoff >> Account Lockout - FailureSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN16-AU-000240Windows Server 2016 must be configured to audit Logon/Logoff - Group Membership successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Group Membership - SuccessSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN16-AU-000250Windows Server 2016 must be configured to audit Logon/Logoff - Logoff successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. - -Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Logoff - SuccessSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN16-AU-000260Windows Server 2016 must be configured to audit Logon/Logoff - Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. - -Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Logon - SuccessSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN16-AU-000270Windows Server 2016 must be configured to audit Logon/Logoff - Logon failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. - -Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Logon - FailureSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN16-AU-000280Windows Server 2016 must be configured to audit Logon/Logoff - Special Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Special Logon records special logons that have administrative privileges and can be used to elevate processes. - -Satisfies: SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Logon/Logoff >> Special Logon - SuccessSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN16-AU-000290Windows Server 2016 must be configured to audit Object Access - Removable Storage successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Object Access >> Removable Storage - Success - -Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.SRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN16-AU-000300Windows Server 2016 must be configured to audit Object Access - Removable Storage failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Object Access >> Removable Storage - Failure - -Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000310Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Policy Change records events related to changes in audit policy. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Policy Change >> Audit Policy Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000320Windows Server 2016 must be configured to audit Policy Change - Audit Policy Change failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Policy Change records events related to changes in audit policy. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Policy Change >> Audit Policy Change - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000330Windows Server 2016 must be configured to audit Policy Change - Authentication Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Policy Change >> Authentication Policy Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000340Windows Server 2016 must be configured to audit Policy Change - Authorization Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Authorization Policy Change records events related to changes in user rights, such as "Create a token object". - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Policy Change >> Authorization Policy Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000350Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Privilege Use >> Sensitive Privilege Use - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000360Windows Server 2016 must be configured to audit Privilege Use - Sensitive Privilege Use failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -Privilege Use >> Sensitive Privilege Use - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000370Windows Server 2016 must be configured to audit System - IPsec Driver successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -IPsec Driver records events related to the IPsec Driver, such as dropped packets. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPsec Driver" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> IPsec Driver - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000380Windows Server 2016 must be configured to audit System - IPsec Driver failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -IPsec Driver records events related to the IPsec Driver, such as dropped packets. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPsec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> IPsec Driver - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000390Windows Server 2016 must be configured to audit System - Other System Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*" - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> Other System Events - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000400Windows Server 2016 must be configured to audit System - Other System Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> Other System Events - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000410Windows Server 2016 must be configured to audit System - Security State Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security State Change records events related to changes in the security state, such as startup and shutdown of the system. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> Security State Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000420Windows Server 2016 must be configured to audit System - Security System Extension successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Security System Extension records events related to extension code being loaded by the security subsystem. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> Security System Extension - SuccessSRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-CC-000280Administrator accounts must not be enumerated during elevation.<VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ - -Value Name: EnumerateAdministrators - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000440Windows Server 2016 must be configured to audit System - System Integrity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -System Integrity records events related to violations of integrity to the security subsystem. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> System Integrity - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN16-AU-000450Windows Server 2016 must be configured to audit System - System Integrity failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -System Integrity records events related to violations of integrity to the security subsystem. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the AuditPol tool to review the current Audit Policy configuration: - -Open an elevated "Command Prompt" (run as administrator). - -Enter "AuditPol /get /category:*". - -Compare the AuditPol settings with the following. - -If the system does not audit the following, this is a finding. - -System >> System Integrity - FailureSRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000010The display of slide shows on the lock screen must be disabled.<VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged-on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen slide show" to "Enabled".Verify the registry value below. - -If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ - -Value Name: NoLockScreenSlideshow - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-MS-000020Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.<VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. - -With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Apply UAC restrictions to local accounts on network logons" to "Enabled". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This applies to member servers. For domain controllers and standalone systems, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - -Value Name: LocalAccountTokenFilterPolicy - -Type: REG_DWORD -Value: 0x00000000 (0) - -This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans should use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to "1" may be required.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000030WDigest Authentication must be disabled on Windows Server 2016.<VulnDiscussion>When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2016. This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled". - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ - -Value Name: UseLogonCredential - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000040Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.<VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Enabled" with "Highest protection, source routing is completely disabled" selected. - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ - -Value Name: DisableIPSourceRouting - -Type: REG_DWORD -Value: 0x00000002 (2)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000050Source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.<VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Enabled" with "Highest protection, source routing is completely disabled" selected. - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: DisableIPSourceRouting - -Value Type: REG_DWORD -Value: 0x00000002 (2)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000060Windows Server 2016 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.<VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via the shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ - -Value Name: EnableICMPRedirect - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN16-CC-000070Windows Server 2016 must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the server's WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002385Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". - -This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ - -Value Name: NoNameReleaseOnDemand - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000080Insecure logons to an SMB server must be disabled.<VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders. Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> "Enable insecure guest logons" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ - -Value Name: AllowInsecureGuestAuth - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000090Hardened UNC paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.<VulnDiscussion>Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> "Hardened UNC Paths" to "Enabled" with at least the following configured in "Hardened UNC Paths": (click the "Show" button to display) - -Value Name: \\*\SYSVOL -Value: RequireMutualAuthentication=1, RequireIntegrity=1 - -Value Name: \\*\NETLOGON -Value: RequireMutualAuthentication=1, RequireIntegrity=1This requirement is applicable to domain-joined systems. For standalone systems, this is NA. - -If the following registry values do not exist or are not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ - -Value Name: \\*\NETLOGON -Value Type: REG_SZ -Value: RequireMutualAuthentication=1, RequireIntegrity=1 - -Value Name: \\*\SYSVOL -Value Type: REG_SZ -Value: RequireMutualAuthentication=1, RequireIntegrity=1 - -Additional entries would not be a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>WN16-CC-000100Command line data must be included in process creation events.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ - -Value Name: ProcessCreationIncludeCmdLine_Enabled - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000110Windows Server 2016 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.<VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Secure Boot" or "Secure Boot and DMA Protection" selected. - -A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: - -https://technet.microsoft.com/itpro/windows/keep-secure/credential-guardFor standalone systems, this is NA. - -Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. - -Open "PowerShell" with elevated privileges (run as administrator). - -Enter the following: - -"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" - -If "RequiredSecurityProperties" does not include a value of "2" indicating "Secure Boot" (e.g., "{1, 2}"), this is a finding. - -If "Secure Boot and DMA Protection" is configured, "3" will also be displayed in the results (e.g., "{1, 2, 3}"). - -If "VirtualizationBasedSecurityStatus" is not a value of "2" indicating "Running", this is a finding. - -Alternately: - -Run "System Information". - -Under "System Summary", verify the following: - -If "Device Guard Virtualization based security" does not display "Running", this is finding. - -If "Device Guard Required Security Properties" does not display "Base Virtualization Support, Secure Boot", this is finding. - -If "Secure Boot and DMA Protection" is configured, "DMA Protection" will also be displayed (e.g., "Base Virtualization Support, Secure Boot, DMA Protection"). - -The policy settings referenced in the Fix section will configure the following registry values. However, due to hardware requirements, the registry values alone do not ensure proper function. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ - -Value Name: EnableVirtualizationBasedSecurity -Value Type: REG_DWORD -Value: 0x00000001 (1) - -Value Name: RequirePlatformSecurityFeatures -Value Type: REG_DWORD -Value: 0x00000001 (1) (Secure Boot only) or 0x00000003 (3) (Secure Boot and DMA Protection) - -A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: - -https://technet.microsoft.com/itpro/windows/keep-secure/credential-guardSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-MS-000120Windows Server 2016 must be running Credential Guard on domain-joined member servers.<VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration". - -A Microsoft article on Credential Guard system requirement can be found at the following link: - -https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirementsFor domain controllers and standalone systems, this is NA. - -Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. - -Open "PowerShell" with elevated privileges (run as administrator). - -Enter the following: - -"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" - -If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. - -Alternately: - -Run "System Information". - -Under "System Summary", verify the following: - -If "Device Guard Security Services Running" does not list "Credential Guard", this is finding. - -The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ - -Value Name: LsaCfgFlags -Value Type: REG_DWORD -Value: 0x00000001 (1) (Enabled with UEFI lock) - -A Microsoft article on Credential Guard system requirement can be found at the following link: - -https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirementsSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000140Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.<VulnDiscussion>Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). - -If this needs to be corrected or a more secure setting is desired, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Not Configured" or "Enabled" with any option other than "All" selected.The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0x00000007 (7)", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ - -Value Name: DriverLoadPolicy - -Value Type: REG_DWORD -Value: 0x00000001 (1), 0x00000003 (3), or 0x00000008 (8) (or if the Value Name does not exist) - -Possible values for this setting are: -8 - Good only -1 - Good and unknown -3 - Good, unknown and bad but critical -7 - All (which includes "bad" and would be a finding)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000150Group Policy objects must be reprocessed even if they have not changed.<VulnDiscussion>Registry entries for group policy settings can potentially be changed from the required configuration. This could occur as part of troubleshooting or by a malicious process on a compromised system. Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> "Configure registry policy processing" to "Enabled" with the option "Process even if the Group Policy objects have not changed" selected.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ - -Value Name: NoGPOListChanges - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000160Downloading print driver packages over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. - -This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off downloading of print drivers over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DisableWebPnPDownload - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000170Printing over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. - -This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off printing over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ - -Value Name: DisableHTTPPrinting - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000180The network selection user interface (UI) must not be displayed on the logon screen.<VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing in to Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Do not display network selection UI" to "Enabled".Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: DontDisplayNetworkSelectionUI - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-MS-000030Local users on domain-joined computers must not be enumerated.<VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Enumerate local users on domain-joined computers" to "Disabled".This applies to member servers. For domain controllers and standalone systems, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnumerateLocalUsers - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000210Users must be prompted to authenticate when the system wakes from sleep (on battery).<VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (on battery)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ - -Value Name: DCSettingIndex - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000220Users must be prompted to authenticate when the system wakes from sleep (plugged in).<VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (plugged in)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ - -Value Name: ACSettingIndex - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000379-GPOS-00164<GroupDescription></GroupDescription>WN16-MS-000040Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server.<VulnDiscussion>Unauthenticated RPC clients may allow anonymous access to sensitive information. Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001967Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> "Restrict Unauthenticated RPC clients" to "Enabled" with "Authenticated" selected.This applies to member servers and standalone systems, It is NA for domain controllers. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ - -Value Name: RestrictRemoteClients - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000240The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. - -This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> "Turn off Inventory Collector" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ - -Value Name: DisableInventory - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN16-CC-000250AutoPlay must be turned off for non-volume devices.<VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable AutoPlay for non-volume devices, such as Media Transfer Protocol (MTP) devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoAutoplayfornonVolume - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN16-CC-000260The default AutoRun behavior must be configured to prevent AutoRun commands.<VulnDiscussion>Allowing AutoRun commands to execute may introduce malicious code to a system. Configuring this setting prevents AutoRun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled" with "Do not execute any autorun commands" selected.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: NoAutorun - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN16-CC-000270AutoPlay must be disabled for all drives.<VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, AutoPlay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables AutoPlay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled" with "All Drives" selected.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ - -Value Name: NoDriveTypeAutoRun - -Type: REG_DWORD -Value: 0x000000ff (255)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000290Windows Telemetry must be configured to Security or Basic.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender, and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds>> "Allow Telemetry" to "Enabled" with "0 - Security [Enterprise Only]" or "1 - Basic" selected in "Options".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ - -Value Name: AllowTelemetry - -Type: REG_DWORD -Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN16-CC-000300The Application event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN16-CC-000310The Security event log size must be configured to 196608 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "196608" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00030000 (196608) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN16-CC-000320The System event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ - -Value Name: MaxSize - -Type: REG_DWORD -Value: 0x00008000 (32768) (or greater)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000330Windows Server 2016 Windows SmartScreen must be enabled.<VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling SmartScreen will warn users of potentially malicious programs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled".This is applicable to unclassified systems; for other systems, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ - -Value Name: EnableSmartScreen - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000433-GPOS-00192<GroupDescription></GroupDescription>WN16-CC-000340Explorer Data Execution Prevention must be enabled.<VulnDiscussion>Data Execution Prevention provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002824The default behavior is for data execution prevention to be turned on for File Explorer. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off Data Execution Prevention for Explorer" to "Not Configured" or "Disabled".The default behavior is for Data Execution Prevention to be turned on for File Explorer. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoDataExecutionPrevention - -Value Type: REG_DWORD -Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000350Turning off File Explorer heap termination on corruption must be disabled.<VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366The default behavior is for File Explorer heap termination on corruption to be disabled. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off heap termination on corruption" to "Not Configured" or "Disabled".The default behavior is for File Explorer heap termination on corruption to be enabled. - -If the registry Value Name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ - -Value Name: NoHeapTerminationOnCorruption - -Value Type: REG_DWORD -Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000360File Explorer shell protocol must run in protected mode.<VulnDiscussion>The shell protocol will limit the set of folders that applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366The default behavior is for shell protected mode to be turned on for File Explorer. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off shell protocol protected mode" to "Not Configured" or "Disabled".The default behavior is for shell protected mode to be turned on for File Explorer. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ - -Value Name: PreXPSP2ShellProtocolBehavior - -Value Type: REG_DWORD -Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN16-CC-000370Passwords must not be saved in the Remote Desktop Client.<VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client. - -Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> "Do not allow passwords to be saved" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: DisablePasswordSaving - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN16-CC-000380Local drives must be prevented from sharing with Remote Desktop Session Hosts.<VulnDiscussion>Preventing users from sharing the local drives on their client computers with Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001090Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> "Do not allow drive redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fDisableCdm - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN16-CC-000390Remote Desktop Services must always prompt a client for passwords upon connection.<VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server. - -Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Always prompt for password upon connection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fPromptForPassword - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>WN16-CC-000400The Remote Desktop Session Host must require secure Remote Procedure Call (RPC) communications.<VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001453Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Require secure RPC communication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: fEncryptRPCTraffic - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>WN16-CC-000410Remote Desktop Services must be configured with the client connection encryption set to High Level.<VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001453Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Set client connection encryption level" to "Enabled" with "High Level" selected.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ - -Value Name: MinEncryptionLevel - -Type: REG_DWORD -Value: 0x00000003 (3)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000420Attachments must be prevented from being downloaded from RSS feeds.<VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Prevent downloading of enclosures" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ - -Value Name: DisableEnclosureDownload - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000430Basic authentication for RSS feeds over HTTP must not be used.<VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Turn on Basic feed authentication over HTTP" to "Not Configured" or "Disabled".The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ - -Value Name: AllowBasicAuthInClear - -Value Type: REG_DWORD -Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-CC-000440Indexing of encrypted files must be turned off.<VulnDiscussion>Indexing of encrypted files may expose sensitive data. This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> "Allow indexing of encrypted files" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ - -Value Name: AllowIndexingEncryptedStoresOrItems - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN16-CC-000450Users must be prevented from changing installation options.<VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001812Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ - -Value Name: EnableUserControl - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN16-CC-000460The Windows Installer Always install with elevated privileges option must be disabled.<VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001812Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ - -Value Name: AlwaysInstallElevated - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-CC-000470Users must be notified if a web-based program attempts to install software.<VulnDiscussion>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. - -If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Not Configured" or "Disabled".The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. - -If the registry value name below does not exist, this is not a finding. - -If it exists and is configured with a value of "0", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ - -Value Name: SafeForScripting - -Value Type: REG_DWORD -Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>WN16-CC-000480Automatically signing in the last interactive user after a system-initiated restart must be disabled.<VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: DisableAutomaticRestartSignOn - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>WN16-CC-000490PowerShell script block logging must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ - -Value Name: EnableScriptBlockLogging - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN16-CC-000500The Windows Remote Management (WinRM) client must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowBasic - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000393-GPOS-00173<GroupDescription></GroupDescription>WN16-CC-000510The Windows Remote Management (WinRM) client must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. - -Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002890CCI-003123Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowUnencryptedTraffic - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN16-CC-000520The Windows Remote Management (WinRM) client must not use Digest authentication.<VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks. Disallowing Digest authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Disallow Digest authentication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ - -Value Name: AllowDigest - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN16-CC-000530The Windows Remote Management (WinRM) service must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: AllowBasic - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000393-GPOS-00173<GroupDescription></GroupDescription>WN16-CC-000540The Windows Remote Management (WinRM) service must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. - -Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002890CCI-003123Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: AllowUnencryptedTraffic - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN16-CC-000550The Windows Remote Management (WinRM) service must not store RunAs credentials.<VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins. - -Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Disallow WinRM from storing RunAs credentials" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ - -Value Name: DisableRunAs - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN16-PK-000010The DoD Root CA certificates must be installed in the Trusted Root Store.<VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs. - -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000185CCI-002470Install the DoD Root CA certificates: - -DoD Root CA 2 -DoD Root CA 3 -DoD Root CA 4 -DoD Root CA 5 - -The InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. - -Open "Windows PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter - -If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 -NotAfter: 12/5/2029 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB -NotAfter: 12/30/2029 - -Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 -NotAfter: 7/25/2032 - -Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -NotAfter: 6/14/2041 - -Alternately, use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates" and click "Add". - -Select "Computer account" and click "Next". - -Select "Local computer: (the computer this console is running on)" and click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". - -For each of the DoD Root CA certificates noted below: - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -DoD Root CA 2 -Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 -Valid to: Wednesday, December 5, 2029 - -DoD Root CA 3 -Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB -Valid to: Sunday, December 30, 2029 - -DoD Root CA 4 -Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 -Valid to: Sunday, July 25, 2032 - -DoD Root CA 5 -Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -Valid to: Friday, June 14, 2041SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN16-PK-000020The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. - -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000185CCI-002470Install the DoD Interoperability Root CA cross-certificates on unclassified systems. - -Issued To - Issued By - Thumbprint -DoD Root CA 2 - DoD Interoperability Root CA 1 - 22BBE981F0694D246CC1472ED2B021DC8540A22F -DoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341 - -The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -NotAfter: 9/6/2019 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -NotAfter: 1/22/2022 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -Issued To: DoD Root CA 2 -Issued By: DoD Interoperability Root CA 1 -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -Valid to: Friday, September 6, 2019 - -Issued To: DoD Root CA 3 -Issued By: DoD Interoperability Root CA 2 -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -Valid to: Saturday, January 22, 2022SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN16-PK-000030The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. - -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000185CCI-002470Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. - -Issued To - Issued By - Thumbprint -DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - 929BF3196896994C0A201DF4A5B71F603FEFBF2E - -The certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -NotAfter: 9/27/2019 - -Alternately use the Certificates MMC snap-in: - -Run "MMC". - -Select "File", "Add/Remove Snap-in". - -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": - -Right-click on the certificate and select "Open". - -Select the "Details" Tab. - -Scroll to the bottom and select "Thumbprint". - -If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. - -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. - -Issued To: DoD Root CA 3 -Issuer by: US DoD CCEB Interoperability Root CA 2 -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -Valid: Friday, September 27, 2019SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN16-DC-000280Domain controllers must have a PKI server certificate.<VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000185Obtain a server certificate for the domain controller.This applies to domain controllers. It is NA for other systems. - -Run "MMC". - -Select "Add/Remove Snap-in" from the "File" menu. - -Select "Certificates" in the left pane and click the "Add >" button. - -Select "Computer Account" and click "Next". - -Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". - -Click "OK". - -Select and expand the Certificates (Local Computer) entry in the left pane. - -Select and expand the Personal entry in the left pane. - -Select the Certificates entry in the left pane. - -If no certificate for the domain controller exists in the right pane, this is a finding.SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN16-DC-000290Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA).<VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000185Obtain a server certificate for the domain controller issued by the DoD PKI or an approved ECA.This applies to domain controllers. It is NA for other systems. - -Run "MMC". - -Select "Add/Remove Snap-in" from the "File" menu. - -Select "Certificates" in the left pane and click the "Add >" button. - -Select "Computer Account" and click "Next". - -Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". - -Click "OK". - -Select and expand the Certificates (Local Computer) entry in the left pane. - -Select and expand the Personal entry in the left pane. - -Select the Certificates entry in the left pane. - -In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. - -If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. - -If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. - -There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: - -The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. - -DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: - -http://iase.disa.mil/pki-pke/function_pages/tools.htmlSRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN16-DC-000300PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA).<VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000185Map user accounts to PKI certificates using the appropriate User Principal Name (UPN) for the network. See PKE documentation for details.This applies to domain controllers. It is NA for other systems. - -Review user account mappings to PKI certificates. - -Open "Windows PowerShell". - -Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled". - -Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. - -If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding. - -For standard NIPRNet certificates the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI). - -Alt Tokens and other certificates may use a different UPN format than the EDI-PI which vary by organization. Verified these with the organization. - -NIPRNet Example: -Name - User Principal Name -User1 - 1234567890@mil - -See PKE documentation for other network domain suffixes. - -If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.SRG-OS-000105-GPOS-00052<GroupDescription></GroupDescription>WN16-DC-000310Active Directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.<VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. - -Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000765CCI-000766CCI-000767CCI-000768CCI-001948Configure all user accounts, including administrator accounts, in Active Directory to enable the option "Smart card is required for interactive logon". - -Run "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): - -Select the OU where the user accounts are located. (By default this is the Users node; however, accounts may be under other organization-defined OUs.) - -Right-click the user account and select "Properties". - -Select the "Account" tab. - -Check "Smart card is required for interactive logon" in the "Account Options" area.This applies to domain controllers. It is NA for other systems. - -Open "PowerShell". - -Enter the following: - -"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" -("DistinguishedName" may be substituted for "Name" for more detailed output.) - -If any user accounts, including administrators, are listed, this is a finding. - -Alternately: - -To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): - -Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) - -Right-click the sample user account and select "Properties". - -Select the "Account" tab. - -If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000020Local accounts with blank passwords must be restricted to prevent access from the network.<VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password does exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: LimitBlankPasswordUse - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000030Windows Server 2016 built-in administrator account must be renamed.<VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename administrator account" to a name other than "Administrator".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "NewAdministratorName" is not something other than "Administrator" in the file, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000040Windows Server 2016 built-in guest account must be renamed.<VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename guest account" to a name other than "Guest".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "NewGuestName" is not something other than "Guest" in the file, this is a finding.SRG-OS-000062-GPOS-00031<GroupDescription></GroupDescription>WN16-SO-000050Audit policy using subcategories must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000169Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: SCENoApplyLegacyAuditPolicy - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-DC-000320Domain controllers must require LDAP access signing.<VulnDiscussion>Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker could cause a client to make decisions based on false records from the LDAP directory. The risk of an attacker pulling this off can be decreased by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man-in-the-middle attacks extremely difficult. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain controller: LDAP server signing requirements" to "Require signing".This applies to domain controllers. It is NA for other systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\NTDS\Parameters\ - -Value Name: LDAPServerIntegrity - -Value Type: REG_DWORD -Value: 0x00000002 (2)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-DC-000330Domain controllers must be configured to allow reset of machine account passwords.<VulnDiscussion>Enabling this setting on all domain controllers in a domain prevents domain members from changing their computer account passwords. If these passwords are weak or compromised, the inability to change them may leave these computers vulnerable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain controller: Refuse machine account password changes" to "Disabled".This applies to domain controllers. It is NA for other systems. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RefusePasswordChange - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000080The setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RequireSignOrSeal - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000090The setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: SealSecureChannel - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000100The setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: SignSecureChannel - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000379-GPOS-00164<GroupDescription></GroupDescription>WN16-SO-000110The computer account password must not be prevented from being reset.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for the system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001967Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Disable machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: DisablePasswordChange - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000120The maximum age for machine account passwords must be configured to 30 days or less.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366This is the default configuration for this setting (30 days). - -Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Maximum machine account password age" to "30" or less (excluding "0", which is unacceptable).This is the default configuration for this setting (30 days). - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: MaximumPasswordAge - -Value Type: REG_DWORD -Value: 0x0000001e (30) (or less, but not 0)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000130Windows Server 2016 must be configured to require a strong session key.<VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. The secure channel connection may be subject to compromise, such as hijacking or eavesdropping, if strong session keys are not used to establish the connection. Requiring strong session keys enforces 128-bit encryption between systems. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ - -Value Name: RequireStrongKey - -Value Type: REG_DWORD -Value: 0x00000001 (1) - -This setting may prevent a system from being joined to a domain if not configured consistently between systems.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>WN16-SO-000140The machine inactivity limit must be set to 15 minutes, locking the system with the screen saver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000057Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Machine inactivity limit" to "900" seconds or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: InactivityTimeoutSecs - -Value Type: REG_DWORD -Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled)SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>WN16-SO-000150The required legal notice must be configured to display before console logon.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. - -Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000048CCI-000050CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message text for users attempting to log on" to the following: - -You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LegalNoticeText - -Value Type: REG_SZ -Value: See message text below - -You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>WN16-SO-000160The Windows dialog box title for the legal banner must be configured with the appropriate text.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. - -Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. - -If an organization-defined title is used, it can in no case contravene or modify the language of the message text required in WN16-SO-000150.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: LegalNoticeCaption - -Value Type: REG_SZ -Value: See message title options below - -"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. - -If an organization-defined title is used, it can in no case contravene or modify the language of the banner text required in WN16-SO-000150. - -Automated tools may only search for the titles defined above. If an organization-defined title is used, a manual review will be required.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-MS-000050Caching of logon credentials must be limited.<VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.This applies to member servers. For domain controllers and standalone systems, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: CachedLogonsCount - -Value Type: REG_SZ -Value: 4 (or less)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000190The setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: RequireSecuritySignature - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000200The setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: EnableSecuritySignature - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000074-GPOS-00042<GroupDescription></GroupDescription>WN16-SO-000210Unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.<VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain-text) password authentication. Sending plain-text passwords across the network when authenticating to an SMB server reduces the overall security of the environment. Check with the vendor of the SMB server to determine if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000197Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ - -Value Name: EnablePlainTextPassword - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000230The setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: RequireSecuritySignature - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN16-SO-000240The setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client. - -Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: EnableSecuritySignature - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000250Anonymous SID/Name translation must not be allowed.<VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "LSAAnonymousNameLookup" equals "1" in the file, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000260Anonymous enumeration of Security Account Manager (SAM) accounts must not be allowed.<VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous logon users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictAnonymousSAM - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN16-SO-000270Anonymous enumeration of shares must not be allowed.<VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001090Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictAnonymous - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000290Windows Server 2016 must be configured to prevent anonymous users from having the same permissions as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Let everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: EveryoneIncludesAnonymous - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN16-SO-000300Anonymous access to Named Pipes and Shares must be restricted.<VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001090Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ - -Value Name: RestrictNullSessAccess - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-MS-000310Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.<VulnDiscussion>The Windows Security Account Manager (SAM) stores users' passwords. Restricting Remote Procedure Call (RPC) connections to the SAM to Administrators helps protect those credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict clients allowed to make remote calls to SAM". -Select "Edit Security" to configure the "Security descriptor:". - -Add "Administrators" in "Group or user names:" if it is not already listed (this is the default). - -Select "Administrators" in "Group or user names:". - -Select "Allow" for "Remote Access" in "Permissions for "Administrators". - -Click "OK". - -The "Security descriptor:" must be populated with "O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.This applies to member servers and standalone systems; it is NA for domain controllers. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: RestrictRemoteSAM - -Value Type: REG_SZ -Value: O:BAG:BAD:(A;;RC;;;BA)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000320Services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.<VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously versus using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow Local System to use computer identity for NTLM" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ - -Value Name: UseMachineId - -Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000330NTLM must be prevented from falling back to a Null session.<VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ - -Value Name: allownullsessionfallback - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000340PKU2U authentication using online identities must be prevented.<VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ - -Value Name: AllowOnlineID - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000120-GPOS-00061<GroupDescription></GroupDescription>WN16-SO-000350Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.<VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. - -Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000803Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: - -AES128_HMAC_SHA1 -AES256_HMAC_SHA1 -Future encryption types - -Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ - -Value Name: SupportedEncryptionTypes - -Value Type: REG_DWORD -Value: 0x7ffffff8 (2147483640)SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>WN16-SO-000360Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords.<VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000196Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: NoLMHash - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000380The LAN Manager authentication level must be set to send NTLMv2 response only and to refuse LM and NTLM.<VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to standalone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ - -Value Name: LmCompatibilityLevel - -Value Type: REG_DWORD -Value: 0x00000005 (5)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000390Windows Server 2016 must be configured to at least negotiate signing for LDAP client signing.<VulnDiscussion>This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ - -Value Name: LDAPClientIntegrity - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000400Session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ - -Value Name: NTLMMinClientSec - -Value Type: REG_DWORD -Value: 0x20080000 (537395200)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000410Session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ - -Value Name: NTLMMinServerSec - -Value Type: REG_DWORD -Value: 0x20080000 (537395200)SRG-OS-000067-GPOS-00035<GroupDescription></GroupDescription>WN16-SO-000420Users must be required to enter a password to access private keys stored on the computer.<VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. - -The cornerstone of the PKI is the private key used to encrypt or digitally sign information. - -If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. - -Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000186Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ - -Value Name: ForceKeyProtection - -Type: REG_DWORD -Value: 0x00000002 (2)SRG-OS-000033-GPOS-00014<GroupDescription></GroupDescription>WN16-SO-000430Windows Server 2016 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.<VulnDiscussion>This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions. - -Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000478-GPOS-00223</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000068CCI-002450Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ - -Value Name: Enabled - -Value Type: REG_DWORD -Value: 0x00000001 (1) - -Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS; otherwise. the browser will not be able to connect to a secure site.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000450The default permissions of global system objects must be strengthened.<VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List (DACL) that specifies who can access the objects with what permissions. When this policy is enabled, the default DACL is stronger, allowing non-administrative users to read shared objects but not to modify shared objects they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ - -Value Name: ProtectionMode - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN16-SO-000460User Account Control approval mode for the built-in Administrator must be enabled.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. - -Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: FilterAdministratorToken - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-SO-000470UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableUIADesktopToggle - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-SO-000480User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged-on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop". - -The more secure option for this setting, "Prompt for credentials on the secure desktop", would also be acceptable.UAC requirements are NA for Server Core installations (this is default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ConsentPromptBehaviorAdmin - -Value Type: REG_DWORD -Value: 0x00000002 (2) (Prompt for consent on the secure desktop) -0x00000001 (1) (Prompt for credentials on the secure desktop)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN16-SO-000490User Account Control must automatically deny standard user requests for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. - -Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: ConsentPromptBehaviorUser - -Value Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-SO-000500User Account Control must be configured to detect application installations and prompt for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableInstallerDetection - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-SO-000510User Account Control must only elevate UIAccess applications that are installed in secure locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableSecureUIAPaths - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN16-SO-000520User Account Control must run all administrators in Admin Approval Mode, enabling UAC.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. - -Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableLUA - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN16-SO-000530User Account Control must virtualize file and registry write failures to per-user locations.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2016 versus Server with Desktop Experience) as well as Nano Server. - -If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ - -Value Name: EnableVirtualization - -Value Type: REG_DWORD -Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-UC-000030Zone information must be preserved when saving attachments.<VulnDiscussion>Attachments from outside sources may contain malicious code. Preserving zone of origin (Internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366The default behavior is for Windows to mark file attachments with their zone information. - -If this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled".The default behavior is for Windows to mark file attachments with their zone information. - -If the registry Value Name below does not exist, this is not a finding. - -If it exists and is configured with a value of "2", this is not a finding. - -If it exists and is configured with a value of "1", this is a finding. - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ - -Value Name: SaveZoneInformation - -Value Type: REG_DWORD -Value: 0x00000002 (2) (or if the Value Name does not exist)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000010The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeTrustedCredManAccessPrivilege" user right, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-DC-000340The Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and -Enterprise Domain Controllers groups on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Access this computer from the network" right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to include only the following accounts or groups: - -- Administrators -- Authenticated Users -- Enterprise Domain ControllersThis applies to domain controllers. It is NA for other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Access this computer from the network" right, this is a finding. - -- Administrators -- Authenticated Users -- Enterprise Domain Controllers - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeNetworkLogonRight" user right, this is a finding. - -S-1-5-32-544 (Administrators) -S-1-5-11 (Authenticated Users) -S-1-5-9 (Enterprise Domain Controllers) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-MS-000340The Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on member servers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Access this computer from the network" user right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to include only the following accounts or groups: - -- Administrators -- Authenticated UsersThis applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Access this computer from the network" user right, this is a finding. - -- Administrators -- Authenticated Users - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeNetworkLogonRight" user right, this is a finding. - -S-1-5-32-544 (Administrators) -S-1-5-11 (Authenticated Users) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000030The Act as part of the operating system user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that the user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeTcbPrivilege" user right, this is a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070). - -Passwords for accounts with this user right must be protected as highly privileged accounts.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000350The Add workstations to domain user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Add workstations to domain" right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Add workstations to domain" to include only the following accounts or groups: - -- AdministratorsThis applies to domain controllers. It is NA for other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Add workstations to domain" right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeMachineAccountPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-UR-000050The Allow log on locally user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeInteractiveLogonRight" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-DC-000360The Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to include only the following accounts or groups: - -- AdministratorsThis applies to domain controllers, it is NA for other systems. - -Verify the effective setting in Local Group Policy Editor. -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeRemoteInteractiveLogonRight" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000070The Back up files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeBackupPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000080The Create a pagefile user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeCreatePagefilePrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000090The Create a token object user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Create a token object" user right, this is a finding. - -If an application requires this user right, this would not be a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeCreateTokenPrivilege" user right, this is a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070). - -Passwords for application accounts with this user right must be protected as highly privileged accounts.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000100The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to include only the following accounts or groups: - -- Administrators -- Service -- Local Service -- Network ServiceVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding. - -- Administrators -- Service -- Local Service -- Network Service - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeCreateGlobalPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) -S-1-5-6 (Service) -S-1-5-19 (Local Service) -S-1-5-20 (Network Service) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000110The Create permanent shared objects user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeCreatePermanentPrivilege" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000120The Create symbolic links user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Create symbolic links" user right can create pointers to other objects, which could expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to include only the following accounts or groups: - -- Administrators - -Systems that have the Hyper-V role will also have "Virtual Machines" given this user right. If this needs to be added manually, enter it as "NT Virtual Machine\Virtual Machines".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeCreateSymbolicLinkPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines", SID S-1-5-83-0). This is not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000130The Debug programs user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeDebugPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070). - -Passwords for application accounts with this user right must be protected as highly privileged accounts.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-DC-000370The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: - -- Guests GroupThis applies to domain controllers. A separate version applies to other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding. - -- Guests Group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. - -S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-MS-000370The Deny access to this computer from the network user right on member servers must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: - -Domain Systems Only: -- Enterprise Admins group -- Domain Admins group -- "Local account and member of Administrators group" or "Local account" (see Note below) - -All Systems: -- Guests group - -Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.This applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding. - -Domain Systems Only: -- Enterprise Admins group -- Domain Admins group -- "Local account and member of Administrators group" or "Local account" (see Note below) - -All Systems: -- Guests group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. - -Domain Systems Only: -S-1-5-root domain-519 (Enterprise Admins) -S-1-5-domain-512 (Domain Admins) -S-1-5-114 ("Local account and member of Administrators group") or S-1-5-113 ("Local account") - -All Systems: -S-1-5-32-546 (Guests) - -Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-DC-000380The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. - -The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following: - -- Guests GroupThis applies to domain controllers. A separate version applies to other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding. - -- Guests Group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SID(s) are not defined for the "SeDenyBatchLogonRight" user right, this is a finding. - -S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-MS-000380The Deny log on as a batch job user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following: - -Domain Systems Only: -- Enterprise Admins Group -- Domain Admins Group - -All Systems: -- Guests GroupThis applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding. - -Domain Systems Only: -- Enterprise Admins Group -- Domain Admins Group - -All Systems: -- Guests Group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SIDs are not defined for the "SeDenyBatchLogonRight" user right, this is a finding. - -Domain Systems Only: -S-1-5-root domain-519 (Enterprise Admins) -S-1-5-domain-512 (Domain Admins) - -All Systems: -S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-DC-000390The Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on as a service" user right defines accounts that are denied logon as a service. - -Incorrect configurations could prevent services from starting and result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include no entries (blank).This applies to domain controllers. A separate version applies to other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are defined for the "Deny log on as a service" user right, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeDenyServiceLogonRight" user right, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-MS-000390The Deny log on as a service user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on as a service" user right defines accounts that are denied logon as a service. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include the following: - -Domain systems: -- Enterprise Admins Group -- Domain Admins GroupThis applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on as a service" user right on domain-joined systems, this is a finding. - -- Enterprise Admins Group -- Domain Admins Group - -If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding. -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SIDs are not defined for the "SeDenyServiceLogonRight" user right on domain-joined systems, this is a finding. - -S-1-5-root domain-519 (Enterprise Admins) -S-1-5-domain-512 (Domain Admins) - -If any SIDs are defined for the user right on non-domain-joined systems, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-DC-000400The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following: - -- Guests GroupThis applies to domain controllers. A separate version applies to other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding. - -- Guests Group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SID(s) are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding. - -S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN16-MS-000400The Deny log on locally user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following: - -Domain Systems Only: -- Enterprise Admins Group -- Domain Admins Group - -All Systems: -- Guests GroupThis applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding. - -Domain Systems Only: -- Enterprise Admins Group -- Domain Admins Group - -All Systems: -- Guests Group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SIDs are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding. - -Domain Systems Only: -S-1-5-root domain-519 (Enterprise Admins) -S-1-5-domain-512 (Domain Admins) - -All Systems: -S-1-5-32-546 (Guests)SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN16-DC-000410The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002314Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: - -- Guests GroupThis applies to domain controllers. A separate version applies to other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding. - -- Guests Group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SID(s) are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding. - -S-1-5-32-546 (Guests)SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN16-MS-000410The Deny log on through Remote Desktop Services user right on member servers must be configured to prevent access from highly privileged domain accounts and all local accounts on domain systems and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. - -In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. - -Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. - -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002314Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: - -Domain Systems Only: -- Enterprise Admins group -- Domain Admins group -- Local account (see Note below) - -All Systems: -- Guests group - -Note: "Local account" is referring to the Windows built-in security group.This applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding. - -Domain Systems Only: -- Enterprise Admins group -- Domain Admins group -- Local account (see Note below) - -All Systems: -- Guests group - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If the following SIDs are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding. - -Domain Systems Only: -S-1-5-root domain-519 (Enterprise Admins) -S-1-5-domain-512 (Domain Admins) -S-1-5-113 ("Local account") - -All Systems: -S-1-5-32-546 (Guests) - -Note: "Local account" is referring to the Windows built-in security group.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-DC-000420The Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to include only the following accounts or groups: - -- AdministratorsThis applies to domain controllers. A separate version applies to other systems. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeEnableDelegationPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-MS-000420The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on member servers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to be defined but containing no entries (blank).This applies to member servers and standalone systems. A separate version applies to domain controllers. - -Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeEnableDelegationPrivilege" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000200The Force shutdown from a remote system user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeRemoteShutdownPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000210The Generate security audits user right must only be assigned to Local Service and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Generate security audits" to include only the following accounts or groups: - -- Local Service -- Network ServiceVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding. - -- Local Service -- Network Service - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeAuditPrivilege" user right, this is a finding. - -S-1-5-19 (Local Service) -S-1-5-20 (Network Service) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000220The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to include only the following accounts or groups: - -- Administrators -- Service -- Local Service -- Network ServiceVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding. - -- Administrators -- Service -- Local Service -- Network Service - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeImpersonatePrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) -S-1-5-6 (Service) -S-1-5-19 (Local Service) -S-1-5-20 (Network Service) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000230The Increase scheduling priority user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Increase scheduling priority" user right can change a scheduling priority, causing performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Increase scheduling priority" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeIncreaseBasePriorityPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000240The Load and unload device drivers user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Load and unload device drivers" user right allows a user to load device drivers dynamically on a system. This could be used by an attacker to install malicious code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeLoadDriverPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000250The Lock pages in memory user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs are granted the "SeLockMemoryPrivilege" user right, this is a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN16-UR-000260The Manage auditing and security log user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering. - -Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000063-GPOS-00032, SRG-OS-000337-GPOS-00129</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000162CCI-000163CCI-000164CCI-000171CCI-001914Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeSecurityPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If the organization has an Auditors group, the assignment of this group to the user right would not be a finding. - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000270The Modify firmware environment values user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeSystemEnvironmentPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000280The Perform volume maintenance tasks user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. This could be used to delete volumes, resulting in data loss or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeManageVolumePrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000290The Profile single process user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeProfileSingleProcessPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000300The Restore files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeRestorePrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN16-UR-000310The Take ownership of files or other objects user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. - -Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to include only the following accounts or groups: - -- AdministratorsVerify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding. - -- Administrators - -For server core installations, run the following command: - -Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt - -Review the text file. - -If any SIDs other than the following are granted the "SeTakeOwnershipPrivilege" user right, this is a finding. - -S-1-5-32-544 (Administrators) - -If an application requires this user right, this would not be a finding. - -Vendor documentation must support the requirement for having the user right. - -The requirement must be documented with the ISSO. - -The application account must meet requirements for application account passwords, such as length (WN16-00-000060) and required frequency of changes (WN16-00-000070).SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-SO-000180The Smart Card removal option must be configured to Force Logoff or Lock Workstation.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".If the following registry value does not exist or is not configured as specified, this is a finding. - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ - -Value Name: scremoveoption - -Value Type: REG_SZ -Value: 1 (Lock Workstation) or 2 (Force Logoff) - -If configuring this on servers causes issues, such as terminating users' remote sessions, and the organization has a policy in place that any other sessions on the servers, such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO.SRG-OS-000121-GPOS-000062<GroupDescription></GroupDescription>WN16-SO-000010Windows Server 2016 built-in guest account must be disabled.<VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000804Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Guest account status" to "Disabled".Verify the effective setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. - -If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. - -For server core installations, run the following command: - -Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt - -If "EnableGuestAccount" equals "1" in the file, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000411The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". - -The system must be restarted for the change to take effect. - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.Different methods are available to disable SMBv1 on Windows 2016, if V-73299 is configured, this is NA. - -If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ - -Value Name: SMB1 - -Type: REG_DWORD -Value: 0x00000000 (0)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN16-00-000412The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". - -The system must be restarted for the changes to take effect. - -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.Different methods are available to disable SMBv1 on Windows 2016, if V-73299 is configured, this is NA. - -If the following registry value is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ - -Value Name: Start - -Type: REG_DWORD -Value: 0x00000004 (4)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000460Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016.<VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.Review the effective User Rights setting in Local Group Policy Editor. - -Run "gpedit.msc". - -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. - -Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) - -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. - -For server core installations, run the following command: - -Secedit /export /areas USER_RIGHTS /cfg c:\path\UserRights.txt - -The results in the file identify user right assignments by SID instead of group name. Review the SIDs for unidentified ones. A list of typical SIDs \ Groups is below, search Microsoft for articles on well-known SIDs for others. - -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. - - -SID - Group -S-1-5-11 - Authenticated Users -S-1-5-113 - Local account -S-1-5-114 - Local account and member of Administrators group -S-1-5-19 - Local Service -S-1-5-20 - Network Service -S-1-5-32-544 - Administrators -S-1-5-32-546 - Guests -S-1-5-6 - Service -S-1-5-9 - Enterprise Domain Controllers -S-1-5-domain-512 - Domain Admins -S-1-5-root domain-519 - Enterprise Admins -S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420 - NT Service\WdiServiceHostSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000470Secure Boot must be enabled on Windows Server 2016 systems.<VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Enable Secure Boot in the system firmware.Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. - -Run "System Information". - -Under "System Summary", if "Secure Boot State" does not display "On", this is finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-00-000480Windows 2016 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.<VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Configure UEFI firmware to run in "UEFI" mode, not "Legacy BIOS" mode.Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. - -Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". - -Run "System Information". - -Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding.SRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN16-AU-000285Windows 2016 must be configured to audit Object Access - Other Object Access Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the "AuditPol" tool to review the current Audit Policy configuration: - -Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as Administrator"). - -Enter "AuditPol /get /category:*" - -Compare the "AuditPol" settings with the following: - -If the system does not audit the following, this is a finding. - -Object Access >> Other Object Access Events - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN16-AU-000286Windows 2016 must be configured to audit Object Access - Other Object Access Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. - -Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. - -Use the "AuditPol" tool to review the current Audit Policy configuration: - -Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as Administrator"). - -Enter "AuditPol /get /category:*" - -Compare the "AuditPol" settings with the following: - -If the system does not audit the following, this is a finding. - -Object Access >> Other Object Access Events - FailureSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN16-DC-000430The password for the krbtgt account on a domain must be reset at least every 180 days.<VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). - -The password must be changed twice to effectively remove the password history.Changing once, waiting for replication to complete and the amount of time equal to or greater than the maximum Kerberos ticket lifetime, and changing again reduces the risk of issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Reset the password for the krbtgt account a least every 180 days. The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected. - -PowerShell scripts are available to accomplish this such as at the following link: -https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Select "Advanced Features" in the "View" menu if not previously selected. - -Select the "Users" node. - -Right click on the krbtgt account and select "Reset password". - -Enter a password that meets password complexity requirements. - -Clear the "User must change password at next logon" check box. - -The system will automatically change this to a system generated complex password.This requirement is applicable to domain controllers; it is NA for other systems. - -Open "Windows PowerShell". - -Enter "Get-ADUser krbtgt -Property PasswordLastSet". - -If the "PasswordLastSet" date is more than 180 days old, this is a finding.WN16-CC-000421<GroupDescription></GroupDescription>WN16-CC-000421The Windows Explorer Preview pane must be disabled for Windows Server 2016.<VulnDiscussion>A known vulnerability in Windows could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane. - -Organizations must disable the Windows Preview pane and Windows Detail pane.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2016DISADPMS TargetWindows 20163157CCI-000366Ensure the following settings are configured for Windows Server 2016 locally or applied through group policy. - -Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn off Preview Pane" to "Enabled". - -Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane "Turn on or off details pane" to "Enabled" and "Configure details pane" to "Always hide".If the following registry values do not exist or are not configured as specified, this is a finding: - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - -Value Name: NoPreviewPane - -Value Type: REG_DWORD - -Value: 1 - -Registry Hive: HKEY_CURRENT_USER -Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - -Value Name: NoReadingPane - -Value Type: REG_DWORD - -Value: 1 - diff --git a/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V2R2_Manual-xccdf.xml b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V2R2_Manual-xccdf.xml new file mode 100644 index 000000000..31caff312 --- /dev/null +++ b/source/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_STIG_V2R2_Manual-xccdf.xml @@ -0,0 +1,5450 @@ +acceptedMicrosoft Windows Server 2016 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 2 Benchmark Date: 04 May 20213.2.2.360791.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +